We are actually working with a Palo engineer right now who is creating a script to do this very thing. As stated above, there is nothing on the GUI or CLI that will perform this function, but you can script it out yourself. ... View more

Incorrect sir...setting service to "ANY" will only allow for the traffic to traverse any port that still matches the specified application. Based off your logic, there would be no need to specify the application. ... View more

Steven, There are two different ways that you can get the config from the Secondary device to sync with the Primary device. 1. Suspend HA on on the Primary and then immediately turn it back on, this will leave the primary in "Passive" mode for a couple minutes allowing you to push the sync from the Secondary. 2. (The easier way) Push the manual sync command in the Secondary device's CLI. Both of these steps worked in getting config changes from the Secondary to the Primary. ... View more

For one, the commit job doesn't automatically kick off like it should (that's an issue in it's self). When we go to kick off the sync (commit), the Primary overwrites any changes that were made on the secondary. I have opened a case with Palo Alto, so hopefully they can figure out where the bug is. Thanks for all of the inputs everyone! ... View more

I don't think you guys are picking up what I'm putting down here...I'm not making policy changes on a Passive/Secondary device, I'm making the policy changes on an ***ACTIVE***/Secondary device while the Primary device is offline. Once the Primary device comes back online, it automatically becomes the active, which is all good and gravy...however, any/all changes made on the previously ***ACTIVE***/Secondary device, don't sync with the NOW Active/Primary. The only way I can get the changes on the previously ***ACTIVE***/Secondary to sync with the Primary device after reinstatement, is to run the sync command from the CLI of the Secondary device. ... View more

Yes, the clocks are synced. It's almost as if there is a bug with the software version that isn't allowing changes made on the secondary device (while in active mode) to transfer to the primary device upon reinstatement. What's even stranger, is that after turning OFF the preemptive mode on both devices (committing, etc), the primary device still automatically becomes active upon reinstatement to the network. It's like there is no difference between preemptive and non-preemptive. ... View more

These are not firewalls, they are M-100 Panoramas (managers). Below is the the "show high-availability all" of our current VM enviroment. The M-100's that we are testing in the lab have been uploaded with the exact configuration snap-shot of our live VM Panoramas. I cannot provide the read out from the M-100s but it shouldn't matter since everything is the same (Config, licneses, software, dynamic updates, etc). PRIMARY: High-Availability:   Local Information:     Version: 1     State: active     Device Information:     Election Option Information:       Priority: primary       Preemptive: yes       Promotion Hold Interval: 2000 ms       Hello Message Interval: 8000 ms       Heartbeat Ping Interval: 1000 ms       Preemption Hold Interval: 1 min       Monitor Fail Hold Up Interval: 0 ms       Addon Master Hold Up Interval: 7000 ms     Version Information:       Build Release: 5.1.3       URL Database: Not Installed       Application Content: 445-2292       Threat Content: 0       Anti-Virus: 1317-1787     Version Compatibility:       Software Version: Match       Application Content Compatibility: Match       Threat Content Compatibility: Match       Anti-Virus Compatibility: Match   Peer Information:     Connection status: up     Version: 1     State: passive     Device Information:       Connection up; Primary HA1 link     Election Option Information:       Priority: secondary       Preemptive: yes     Version Information:       Build Release: 5.1.3       URL Database: Not Installed       Application Content: 445-2292       Threat Content: 0       Anti-Virus: 1317-1787   Configuration Synchronization:     Enabled: yes     Running Configuration: synchronized SECONDARY: High-Availability:   Local Information:     Version: 1     State: passive     Last suspended state reason: User requested     Device Information:     Election Option Information:       Priority: secondary       Preemptive: yes       Promotion Hold Interval: 2000 ms       Hello Message Interval: 8000 ms       Heartbeat Ping Interval: 1000 ms       Preemption Hold Interval: 1 min       Monitor Fail Hold Up Interval: 0 ms       Addon Master Hold Up Interval: 7000 ms     Version Information:       Build Release: 5.1.3       URL Database: Not Installed       Application Content: 445-2292       Threat Content: 0       Anti-Virus: 1317-1787     Version Compatibility:       Software Version: Match       Application Content Compatibility: Match       Threat Content Compatibility: Match       Anti-Virus Compatibility: Match   Peer Information:     Connection status: up     Version: 1     State: active     Last suspended state reason: User requested     Device Information:       Connection up; Primary HA1 link     Election Option Information:       Priority: primary       Preemptive: yes     Version Information:       Build Release: 5.1.3       URL Database: Not Installed       Application Content: 445-2292       Threat Content: 0       Anti-Virus: 1317-1787   Path Monitoring Information:     Enabled: yes     Failure condition: any     Groups:       No path monitoring groups   Configuration Synchronization:     Enabled: yes     Running Configuration: synchronized Again, the preemptive function works correctly up to the point where it doesn't Sync the recently config changes from the secondary to the primary. I have to manually run the sync command from the secondary CLI in order to make the sync work. ... View more

I understand all of that...the issue is, I want the "Secondary" to be able to send any new configs to the now, "Active/Primary" upon reinstatement. With the preemptive setting in place, upon reinstatement of the Primary device (making it Active), that device wants to sync it's config with the secondary...I don't want that! By this happening, I'm erasing any config changes that I made, on the secondary, while the primary was down. ... View more

I've done all that...makes no difference. I have tried every kind of way imaginable and the outcome is always the same: The primary automatically switches back to active and the changes on the secondary don't sync with the primary. I have to manually push the sync from the cli of the secondary to properly sync them...I shouldn't have to do that. ... View more

Still the same issue. We set up a case with Palo...hopefully they can figure out the issue. ... View more

So, once the primary was plugged back into the network, it automatically went into ACTIVE mode...how is this?? That tells me that there is absolutely NOTHING different between preemptive and non-preemptive. What we are trying now is to leave preemptive off on the primary but turn it on the secondary and see what happens. ... View more

I actually just got done doing that and disconnected the primary from the switch. The secondary automatically switched to active (as expected) and I created another rule. Once the commit is done, I will plug the primary back into the network. Hopefully the primary stays as passive (since preemptive is turned off). I also hope that the sync process kicks off automatically. ... View more

Ok, so when the Primary came back in line, as assumed it went straight into active mode. When you go to sync it overwrites the changes you made on the secondary. I was able to get the primary, once back online, to go into passive state and push the sync from the secondary, which worked! The issue is, after only a minute or two, the primary automatically reverts back to active. The M-100 is currently in preemptive mode, so I don't see why this is happening. These devices should successfully/correctly sync without me having to do all of this extra. Thoughts? ... View more

Yeah, only the PEER will show the sync job. We have successfully performed the sync. Our next step is to unplug the primary M-100 from the switch (totally take it off the network) to cause the secondary to take over as Active/Passive on it's own. I will then make a config change on the Active/Secondary. Once that is complete, I am going to plug the Primary back into the switch...this should automatically make the Primary Active. The issue is that when we do this, the Primary wants to overwrite the config. ... View more

Roger that...stand by... ... View more