T Techclick ← All lessons
Palo Alto · PAN-OS · High Availability · Interactive lesson

PAN-OS HA — Active/Passive vs Active/Active

A ticket says “both firewalls are active and the LAN is on fire.” That is usually split-brain, not high availability. This lesson teaches the real pair model — HA1 / HA2 / HA3, election, preempt, path and link monitors, floating IPs — then walks the Device → High Availability runbook you can prove in the Dashboard widget and CLI.

18 min read · L2 primary · Quiz at end

After this page you can

Hero · one pair, two roles
Two NGFWs in a pair: one active forwarding, one passive mirroring state over HA cables
Notice: one pair, one session book. Green HA state means the book is synced — it does not prove the business transaction survived failover.
Quick answer (say this out loud)

Active/Passive is the default: one firewall forwards, the peer mirrors config on HA1 and sessions on HA2, then takes over with gratuitous ARPs. Active/Active is not double throughput — both peers process traffic, need HA3 for session setup / asymmetric packets, and use floating IPs (or ARP load-sharing) so neighbours have a stable next hop. Prefer A/P unless you truly need two live routing instances. Enable Heartbeat Backup (or HA1-Backup on a different subnet) so a cut HA1 cable does not become split-brain.

1. Why HA is not a magic uptime button

Two identical PAN-OS boxes with a green High Availability widget still drop Salesforce if you never tested the same transaction after failover. HA syncs firewall state. It does not reconverge OSPF for you, flip a silent LACP neighbour, or keep Layer 7 inspection on sessions that already failed over in Active/Active.

The ticket you will actually get is one of three: the pair never formed, both boxes think they are active (split-brain), or failover happened and users still black-hole because the new-active never sent G-ARPs / never had routes.

Visual · two modes, two jobs
Decision diamond splitting into Path A single active firewall and Path B two active firewalls
Path A is Active/Passive — simpler, L2-capable, one forwarder. Path B is Active/Active — two live dataplanes, extra HA3 + session-owner design.

What HA buys you

A second chassis that already has the config and (if HA2 is up) the session table, so TCP does not have to start over after a box or link death.

What HA does not buy you

Double rated throughput. Palo Alto’s HA Modes page is explicit: Active/Active does not load-balance. Size the survivor for 100% of peak with content inspection on.

2. Mental model — three links, two modes

Memorize the cables before you open Device → High Availability. Most PCNSE and production tickets collapse to “which link died?”

Feel · HA1 then HA2 then HA3
Three glass panels labeled HA1 HA2 HA3 for control, state sync, and packet forwarding
HA1 talks. HA2 copies the session book. HA3 (Active/Active only) forwards the actual packet to the peer that must own or set up the session.
Flow 1 · what each HA link actually carries
One pair · three jobs (HA4 is cluster-only) HA1 · Control Layer 3 · needs an IP Hellos, heartbeats (ICMP) HA state + config sync Routing / User-ID mgmt sync TCP 28769 / 28260 · 28 if enc Cut HA1 with no backup = split-brain HA2 · Data / state Layer 2 (default ethertype 0x7261) Sessions, FIB, ARP, IPSec SAs Unidirectional except keep-alive Active → passive (or A-pri → A-sec) or IP proto 99 · UDP/29281 Keep-alive on; enable session sync HA3 · Packet forward Active/Active only MAC-in-MAC · no L3 · no encrypt Session setup + asymmetric flow HSCI or AE; jumbo frames No HA3-backup object Use AE / dual HSCI for redundancy Backup rules (official HA Links page) HA1-backup + HA2-backup: different subnet from primary, no overlapping IPs, separate physical ports. HA1-backup uses TCP 28770 / 28260. Heartbeat Backup = hellos over the MGT port (TCP 28771). Enable it when HA1 is a dedicated or in-band port. Do not enable it if MGT is already the HA1 link. HA4 / HA4-backup is for HA clusters (session cache between cluster members) — not a pair substitute for HA1–HA3.

Read left → right. A/P usually stops at HA1 + HA2. A/A adds HA3. Cluster members that are not a pair use HA4, not HA1–HA3 between non-pair members.

Say this out loud

HA1 is the control plane conversation. HA2 is the session book copy. HA3 is “here, you process this packet.” If HA1 dies and nothing else carries heartbeats, both boxes promote themselves.

TermMeaning before you click Enable HA
Group ID1–63. Identifies the pair. Must be unique if multiple pairs share a broadcast domain. Both peers match.
Device IDActive/Active only: 0 = active-primary, 1 = active-secondary. Lower ID = higher priority for that role.
Device Priority0–255. Lower number = higher priority. Used when Preemptive is on both peers.
PreemptiveOff by default. If on both peers, the healthier higher-priority firewall takes the active / active-primary role back after it recovers (after Preemption Hold Time, default 1 min).
Passive Link StateA/P only. Shutdown (default) holds dataplane links down. Auto leaves them physically up but not forwarding — faster failover. Do not use Auto if the firewall has Layer 2 interfaces (loop risk).
Session ownerA/A only. The peer that does App-ID / Content-ID / threat and writes Traffic logs. Help recommends First Packet.
Session setupA/A only. Who creates the session. Help recommends First Packet (or IP Modulo with First Packet owner). Primary Device on both owner and setup makes A/A behave like A/P.
Floating IPA/A Layer 3. An address that moves to the surviving peer with a virtual MAC. Hosts use it as default gateway. Failover = GARP, not a new DHCP lease.

3. Decision flow — A/P or A/A

Draw the topology first. The mode decision is a flowchart, not a brand preference. Official HA Modes: A/P works in virtual wire, Layer 2, and Layer 3. A/A works in virtual wire and Layer 3 only — not Layer 2. A/A cannot be a DHCP client; only the active-primary can be a DHCP relay.

Flow 2 · pick the mode before you cable HA3
Start at the topology, not at “we paid for two boxes” Need Layer 2 switching on the pair? L2 on the pair? Yes → A/P only Active/Passive L2 / vwire / L3 Need two live routing instances all the time? Stay A/P Default · easier to debug Active/Active Add HA3 + jumbo Floating IP or ARP-LS Size survivor = 100% Hard stops from HA Modes help A/A is not load-balancing. ECMP, dual ISPs, or an external load balancer can share sessions — the pair will not hash for you. If one peer dies, the survivor must inspect every remaining session. Oversubscribe that box and you get latency, not “HA.”

Diamond = decision. Most campuses stop at Active/Passive. Take Active/Active only when both firewalls must stay live with their own routing instances.

4. How to choose (and what A/A is not)

Use this table in design reviews. If the room cannot answer the “survivor capacity” row, you are not ready for Active/Active.

Active/PassiveActive/Active
Who forwardsOne active dataplane. Passive is synced and ready.Both dataplanes forward. Roles are active-primary and active-secondary.
Supported deploymentsVirtual wire, Layer 2, Layer 3.Virtual wire and Layer 3 only. No Layer 2 pair.
Links requiredHA1 + HA2 (plus backups).HA1 + HA2 + dedicated HA3.
DHCPNormal.No DHCP client. Only active-primary can be a DHCP relay; active-secondary drops DHCP broadcasts.
How neighbours find youInterface IPs live on the active. Failover = G-ARPs from the new-active.Floating IPs + virtual MAC (or ARP load-sharing). Each peer also keeps a local interface IP.
L7 inspectionAlways on the active.On the session owner. If that peer dies, existing sessions fail over without L7 until they are new sessions.
TroubleshootingOne forwarding path. Prefer this unless you have a written A/A reason.Session owner + session setup + HA3 + NAT device-binding. Harder packet walks.
When to pick itAlmost every pair. Including “we want fast failover.”Two live routing instances, full-time use of both boxes, or a documented asymmetric design you can operate.
Common interview trap

“Active/Active doubles throughput.” Official wording: an A/A pair can temporarily process more than one firewall, but that must not be the design. A failure dumps everything on the survivor. If that box cannot inspect peak traffic, you designed an outage.

5. Runbook — cables, Device HA, monitors

Primary source for this block: Configure Active/Passive HA plus HA General Settings (Device → High Availability → General) and Define HA Failover Conditions. Repeat the same field names on peer 2. Then commit both, and Sync to peer from the active Dashboard widget.

Lab placeholders below use RFC 5737 / RFC 3849 space. Replace with your pair. Never copy a production HA key or management IP into a lesson screenshot.

Side A — Physical / peer reachability

  1. Cable the control and data links

    Dedicated HA ports: HA1-to-HA1 and HA2-to-HA2 (crossover if back-to-back). No dedicated ports: management port as HA1 (best practice on small platforms) and a dataplane port with Interface Type = HA for HA1-backup and for HA2. A/A: add HA3 on HSCI or an AE; enable jumbo frames because HA3 exceeds 1,500 bytes.

  2. Allow HA through any filter in the path

    HA1 cleartext is TCP 28769 and 28260; encrypted HA1 is TCP 28. HA1-backup adds 28770. Heartbeat Backup on MGT is 28771. HA2 may be raw Ethernet, IP protocol 99, or UDP 29281. If MGT has a Permitted IP list, add the peer HA1 address.

  3. Enable ping on Management

    Path: Device → Setup → Interfaces → Management. Permit Ping so Heartbeat Backup can actually exchange ICMP. Management ports must route to each other if you rely on that backup.

Side B — Device → High Availability (both peers)

  1. Setup

    Path: Device → High Availability → General → edit Setup. Set Group ID (same on both). Mode = Active Passive or Active Active. A/A: set Device ID 0 on the intended active-primary and 1 on the peer. Check Enable HA and Enable Config Sync. Enter Peer HA1 IP Address and Backup Peer HA1 IP Address.

  2. HA Communications

    Path: Device → High Availability → HA Communications. Control Link (HA1): port, IPv4/IPv6, netmask; gateway only if HA1 is routed. Optional Encryption Enabled after you export/import the HA key under Device → Certificate Management → Certificates. Repeat for HA1 Backup on a different subnet. Data Link (HA2): port, transport (ethernet / IP / UDP), Enable Session Synchronization, HA2 Keep-alive (default threshold 10,000 ms). Add HA2 Backup. A/A: configure the HA3 packet-forwarding link (HSCI or AE).

  3. Election Settings

    Edit Election Settings. Device Priority: lower number on the firewall you want active. Preemptive: enable on both if you want that preference after recovery; leave off if you want fewer failovers. Heartbeat Backup: on when HA1 is dedicated or in-band; off when MGT already is HA1. Timers: leave Recommended unless you measured a need for Aggressive / Advanced.

  4. Active/Passive Settings

    A/P: Passive Link State = Auto for faster failover on L3/vwire pairs with no L2 interfaces; Shutdown if you have L2 or you cannot trust neighbours to ignore a green link. Monitor Fail Hold Down Time is how long a firewall stays non-functional after a monitor failure before it may become passive again (1–60 min).

https://192.0.2.10/#device/high-availability/general
Training mock · not live

Device → High Availability → General

High Availability · Setup + Election

General HA Communications Link and Path Monitoring Active/Active Config
12
Active Passive
192.0.2.2
198.51.100.2
50 · lower = preferred active
Recommended
Enable HA · Enable Config Sync
Preemptive · off (enable on both only if you want fail-back)
Heartbeat Backup · on (HA1 is dedicated, MGT is not HA1)

Training values only (RFC 5737). Same Group ID on both peers. Do not enable Heartbeat Backup if the management port is already the HA1 control link.

Cancel OK · Commit

Click next: HA Communications → fill HA1 / HA1 Backup / HA2 → then Link and Path Monitoring. Source: HA General Settings + Configure Active/Passive HA steps 4–13.

Side C — Link + path monitors, then A/A extras

  1. Link Monitoring

    Path: Device → High Availability → Link and Path Monitoring. Add a Link Group by Name, Enabled, Failure Condition Any (default) or All, then Add the physical interfaces (usually the WAN and LAN uplinks). Optionally set the set-of-groups Failure Condition (default Any). Default behaviour: any link in any group failing moves A/P to non-functional (A/A to tentative).

  2. Path Monitoring

    Add Virtual Router Path (or Logical Router Path / Virtual Wire Path / VLAN Path). VLAN path monitoring is A/P only. Give the path group a Name, Enabled, Failure Condition Any/All. Ping Interval default 200 ms (range 200–60,000). Ping Count default 10 (range 3–10). Add a Destination IP Group and the IPs you can actually reach through that VR/vwire — typically the upstream router or a probe address, not a random public anycast. Virtual-wire / VLAN path groups also need a Source IP.

  3. Active/Active Config (only if Mode = Active Active)

    Path: Device → High Availability → Active/Active Config. Set Session Owner Selection to First Packet (recommended) or Primary Device. Set Session Setup to First Packet (recommended), IP Modulo, or Primary Device. Add a Virtual Address: Floating (with Device 0 / Device 1 priority; optional bind to Active-Primary) or ARP Load Sharing. You can mix types (ARP-LS on LAN, floating on WAN).

https://192.0.2.10/#device/high-availability/link-and-path-monitoring
Training mock · not live

Device → High Availability → Link and Path Monitoring

Link and Path Monitoring

General HA Communications Link and Path Monitoring
LG-Uplinks
Any
ethernet1/1 (untrust) · ethernet1/2 (trust)
VR-default · Add Virtual Router Path
203.0.113.1 · upstream (training)
200 (default)
10 (default)
Enabled · Path Monitoring Failure Condition = Any

Ping something the VR can actually reach. A public anycast that blackholes from only one ISP will flap the pair. Last device standing: if the peer is already non-active, a lone remaining firewall will not leave active just for link/path failure.

Cancel OK · Commit

Click next: Commit both peers → Dashboard High Availability widget → Sync to peer from the active. Source: Define HA Failover Conditions.

Election, in the order operators forget

Health first (heartbeat / hello / link / path / internal chip). Then, if Preemptive is enabled on both, the lower Device Priority number wins (A/A uses Device ID the same way: 0 preferred over 1). If priorities tie, the firewall with the lowest MAC on the HA1 control link becomes active. Preemption is logged in System logs.

6. Runtime path — failover, floating IP, HA3

After go-live the pair is a state machine, not a checkbox. Official failover triggers: missed heartbeats/hellos, a failed link group, a failed path group, packet-path health, admin suspend, or preemption.

Ops · prove it on the desk, not from memory
Operations desk with a monitor showing health checks used to prove HA failover
Green HA widget is necessary and not sufficient. Replay the same HTTPS / SIP / VPN flow after the role swap.

Active/Passive takeover

Default heartbeat is an ICMP ping every 1,000 ms; three consecutive losses declare the peer down (see HA Timers). Hello interval default is 8,000 ms. After the peer-failure declaration, Promotion Hold Time expires and the passive becomes active. Dataplane links come up (or were already up if Passive Link State = Auto). The new-active sends gratuitous ARPs for every interface IP it now owns so switches rewrite MAC tables. Sessions that were synced on HA2 continue.

Active/Active — floating IP + HA3

Each L3 interface keeps a local IP and can own a floating IP. Hosts point default-gateway at the floating address. The owner answers ARP with a virtual MAC (vendor OUI plus Device ID / Group ID / Interface ID bits). On link, path, or firewall failure the floating IP and virtual MAC move; the surviving firewall GARPs. By default the address returns to the Device ID it is bound to after recovery — unless you checked Floating IP bound to the Active-Primary HA device.

If the firewall that receives the first packet is not the session owner, it sends that packet over HA3 to the owner. The owner does Layer 7 and logging. Help’s usual recommendation: Session Owner = First Packet, Session Setup = IP Modulo (or First Packet) to keep HA3 quiet. Set both to Primary Device when you want A/A to act like A/P, or when you need all pcaps on one box.

Proof commands — run on both peers
show high-availability state
show high-availability all
show high-availability state-synchronization
show high-availability link-monitoring
show high-availability path-monitoring

# planned failover (not yanking HA1)
request high-availability state suspend
# after the peer is active and traffic is proven:
request high-availability state functional
Dashboard widget = the commit-done check

On the active (or active-primary): local state matches the design, peer is passive / active-secondary, Running Config = synchronized. On the passive: local = passive, Running Config = synchronized. Then click Sync to peer if config still shows out of sync. A pair that is “HA enabled” with unsynced config is two different firewalls.

7. Traps, split-brain, proof checklist

SymptomLikely causeFirst proof
Both firewalls active; duplicate IPs; LAN storm Split-brain: HA1 (and backups) lost, so each peer missed heartbeats while still forwarding. Cable / encrypt / subnet of HA1 + HA1-backup. Enable Heartbeat Backup if HA1 is not the MGT port. System logs for HA state.
Failover works, then flaps back and forth until one is suspended Path/link monitor fails on both, or Passive Link State = Shutdown so the new-active cannot ping until it is active — a loop. Flap Max (default 3 in 15 minutes) suspends the flapping unit. Last device standing then stays active. show high-availability path-monitoring. Fix the probe. A suspended firewall needs an operator: request high-availability state functional.
New-active is up; users still hairpin to the dead MAC No G-ARPs seen, or the switch CAM / silent host did not update. A/A: floating IP not configured, so neighbours still ARP the dead local IP. Packet capture GARP on the new-active data interface. Check floating IP ownership and virtual MAC.
Sessions reset on failover HA2 down, session sync disabled, or HA2 keep-alive failed and state sync stopped. show high-availability state-synchronization. HA2 keep-alive + HA2-backup.
Preferred box never becomes active again Preemptive off (default), or enabled on only one peer, or Device Priority is not lower on the preferred box. Election Settings on both. Lower number = higher priority. Preemption Hold Time (default 1 min).
A/A: App-ID / threat “missing” after one peer died Expected for sessions that already existed: owner failure → peer inherits sessions without L7 on those flows. New sessions inspect again. Do not promise seamless L7 on inherited A/A sessions.
HA1-B only connected; dataplane restart → split-brain On several platforms HA1-B rides the dataplane. Official HA Ports: connect both HA1-A and HA1-B. Physical audit. Do not run a pair on HA1-B alone.
Do not yank HA1 to “test failover”

Help’s own test language is: uncable the active firewall or use request high-availability state suspend. Pulling only HA1 is how you create split-brain if backups are missing. Pull a monitored dataplane link, or suspend, then watch the peer promote.

Pilot checklist

Knowledge check

Six judgment items. Map each miss back to the section in the reason. Check answers, then Reset if you want another pass.

Q1

Design review: “We will run Active/Active so each firewall only needs to be sized for half of peak HTTPS.” What do you change?

Correct: b. HA Modes is explicit: Active/Active is not load-balancing. ECMP / dual ISP / an external balancer can share sessions, but a peer failure puts everything on one box with content inspection still on. Re-read How to choose.
Q2

Which statement about the three pair links is accurate?

Correct: c. HA1 = control (L3, IPs, TCP 28769/28260 or 28). HA2 = state (default L2 ethertype 0x7261, unidirectional except keep-alive). HA3 = A/A packet-forwarding, MAC-in-MAC, no L3. Backups must be a different subnet. Re-read Mental model.
Q3

FW-A Device Priority 50, FW-B 100. Preemptive is enabled only on FW-A. FW-A fails, FW-B becomes active, FW-A recovers. What happens?

Correct: c. Device Priority and Preemption help: enable preemption on both firewalls or the recovered higher-priority unit does not take the role back. MAC on HA1 is only the tie-breaker when priorities are equal. Re-read Election in the runbook.
Q4

HA1 cable is cut. Dedicated HA1-backup was never configured. Heartbeat Backup is off. Both dataplanes stay up. What is the incident name and the first durable fix?

Correct: d. Official Configure A/P text: HA1 down → missed heartbeats while the box still works → each peer starts services → split-brain. Heartbeat Backup sends redundant hellos on the management port (do not enable it if MGT already is HA1). Re-read Traps.
Q5

The WAN SFP stays optically up but the upstream router 203.0.113.1 is dead. You want the pair to fail over. What do you configure?

Correct: a. Link monitoring sees NIC up/down only. Path monitoring pings destination IPs (default interval 200 ms, count 10). Hello default is 8,000 ms, not 8. HA2 keep-alive logs (A/P) — it is not your WAN next-hop detector. Re-read Side C in the runbook.
Q6

Active/Active Layer 3. Hosts use 192.0.2.254 as default gateway. Peer-1 fails. What should the network do, and who still does App-ID on a brand-new session that arrives on peer-2?

Correct: b. Floating IP + virtual MAC move; survivor GARPs. Session owner does L7 and logging. First Packet on the live peer means that peer owns new sessions. Old sessions that belonged to the dead owner fail over without L7 — that is the Session Owner page, not a bug. Re-read Runtime path.

Sources

Related: NAT deep-dive · Static / OSPF / BGP · PBF & multi-VR · PAN-OS architecture · Security policy fundamentals