High availability (HA) is the technology that keeps your network running without interruption when a firewall fails, crashes, or loses power. It matters for the PCNSE exam because you will be asked how to configure a pair of Palo Alto firewalls so that one automatically takes over if the other goes down, and this is one of the most heavily tested real-world deployment scenarios.
Jump to a section
A simple way to picture High Availability Configuration and Active/Passive Setup
52,000 flights per day in the US alone rely on a two-pilot cockpit to land safely, even if one pilot has a heart attack. That is exactly how active/passive high availability (HA) works for a Palo Alto Networks firewall. In a commercial aeroplane, the captain (active pilot) flies the plane while the first officer (passive pilot) monitors everything. They share the same instruments, flight plan, and radio frequencies through a shared panel. If the captain collapses, the first officer grabs the controls instantly with the exact same situational awareness. There is no handover delay, no fumbling for charts, because every decision and action was synchronised in real time. The plane does not drop 10,000 feet while a new pilot runs from the cabin. Now picture that with your firewall. The active firewall (captain) processes all your company's traffic, inspects packets, and enforces security policies. The passive firewall (first officer) stays synchronised with the same configuration, session table, and security rules via a dedicated heartbeat link. If the active firewall fails from a power loss, software crash, or link failure, the passive firewall takes over within seconds, carrying the exact same state. The network never loses connection, and users do not notice a hiccup. This analogy maps precisely to active/passive HA because the passive unit is not a backup that needs rebooting or manual configuration. It is a hot standby, always ready with the latest synchronised data, just like the first officer who has been monitoring the entire flight.
High availability (HA) is a setup where you use two identical firewalls working together to prevent a single point of failure. A single point of failure is any component that, if it breaks, causes the whole network to stop working. Without HA, if your only firewall loses power, every user in the company loses internet access, every remote worker disconnects from the VPN, and the business grinds to a halt. HA solves this by pairing two firewalls so that the second one takes over seamlessly if the first one fails. The Palo Alto Networks implementation of HA supports two modes: active/active and active/passive. In the PCNSE exam, you will focus heavily on active/passive because it is simpler, more common, and has fewer tricky configuration pitfalls.
In active/passive HA, the first firewall is called the active unit. It handles all traffic, inspects packets, enforces security policies, and maintains all active sessions. The second firewall is called the passive unit. It does not process any traffic at all. It sits idle, but it is not turned off or disconnected. It maintains a constant connection to the active unit using two dedicated interfaces: the control link (also called the HA1 link) and the data link (also called the HA2 link). The control link (HA1) is used to exchange heartbeat messages. A heartbeat is a small periodic signal sent every few seconds so each firewall knows the other is alive and well. If the passive unit stops hearing heartbeats from the active unit, it assumes the active unit has failed and triggers a failover. The data link (HA2) is used to synchronise session state and configuration data. Session state means information about every active connection currently passing through the firewall, such as a user streaming a video or a database query being executed. The passive unit copies this data constantly so that if it takes over, it knows exactly which connections are in progress and can continue them without disruption.
To set up active/passive HA, you must connect the two firewalls physically using dedicated HA ports. Typically, you use one pair of Ethernet ports for HA1 (control) and another pair for HA2 (data). You configure these ports on both firewalls with IP addresses in a private subnet that no other devices use. Then you assign one firewall a higher priority (lower numerical value, like 100) to make it the preferred active unit, and the other a lower priority (like 200) so it stays passive unless the first fails. The firewalls elect the active unit based on priority, then on serial number if priorities are equal. Once the pair is formed, you enable HA on both units, and they begin exchanging heartbeats and synchronising configuration. If the active unit fails, the passive unit promotes itself to active, assigns its own interfaces the virtual IP addresses (also called floating IP addresses) that the network devices had been using, and starts processing traffic. All the while, the stateful inspection continues without interruption because the session table was synchronised.
Stateful inspection is a core Palo Alto Networks feature where each firewall tracks not just individual packets, but the entire conversation between two devices. For example, when you request a web page, your computer sends a SYN packet, the server replies with SYN-ACK, and your computer sends an ACK. The firewall keeps a record of this conversation in its session table. If the firewall fails mid-conversation and a new firewall takes over with no session table, the new firewall sees the next packet and does not know it belongs to an existing conversation. It drops the packet, and the user has to re-request the webpage. That is a disruption. HA with session synchronisation prevents this by copying the entire session table from the active to the passive unit over the HA2 link every time a session changes.
Failover is the process of switching from the active unit to the passive unit. Failover can be triggered by several events: loss of heartbeat, failure of a monitored interface (a link going down), or failure of a monitored path (the firewall can reach a next-hop router but the router cannot reach the internet). You configure which events trigger a failover in the HA setup. For example, you can configure the firewall to monitor its external internet-facing interface. If that interface goes down, the passive unit takes over, and if its own external interface is up, it becomes active and traffic flows again. This is called path monitoring. You can also configure link monitoring, which only checks the physical link state of selected interfaces.
One of the most important concepts for the PCNSE exam is the preemptive setting. Preemptive means that if the active firewall fails, the passive firewall takes over, and then the original active firewall comes back online later. In a preemptive setup, the original firewall is assigned a higher priority (lower number) so it automatically takes back the active role once it is healthy again. In a non-preemptive setup, the original firewall stays passive even after recovery, because the current active firewall (the former passive one) holds the role. The exam tests your understanding of when to use each mode and how they affect network stability.
Configuration synchronisation ensures that when you make a change on the active firewall, such as adding a new security rule or updating an address object, that change is automatically pushed to the passive firewall. You do not have to configure both firewalls separately. This is done through the HA1 link. The entire running configuration is mirrored, so both firewalls are identical at all times. The only things that are not synchronised are the HA-specific settings themselves, such as the HA interface IP addresses and priority values, because those are unique to each firewall.
Licensing and subscriptions, like Threat Prevention or URL Filtering, must be installed on both firewalls independently. They are not synchronised through HA. You must purchase a licence for each firewall in the HA pair. Most organisations buy identical models and licences so that when failover occurs, the passive unit has exactly the same capabilities.
To test whether your HA setup works correctly, you can initiate a manual failover from the active unit's web interface or CLI. This shuts down the active firewall or forces it into passive mode, and the other unit takes over. You should test this regularly in a lab environment before deploying to production. Production means the live network where real users and applications depend on the firewalls.
Physical Connection
Connect the two firewalls using dedicated cables: one for HA1 (control link) and one for HA2 (data link). Use separate Ethernet ports that are not used for data traffic. For example, use port 7 on both firewalls for HA1 and port 8 for HA2. This prevents congestion and ensures failover communication is reliable.
Initial Configuration and IP Assignment
Configure a unique IP address on each firewall's HA1 interface in the same private subnet, such as 10.0.0.1/30 and 10.0.0.2/30. Do the same for HA2 using a different subnet, e.g., 10.0.1.1/30 and 10.0.1.2/30. These IPs are only used for communication between the two firewalls and must not overlap with any other network.
Set Priority and Enable HA
Assign a lower priority value (e.g., 100) to the firewall you want to be the active unit and a higher value (e.g., 200) to the passive unit. Lower numbers win the election. Then enable HA on both firewalls. The firewalls will begin exchanging heartbeats and the passive unit will synchronise its configuration from the active unit.
Configure Monitoring
Select which interfaces and paths to monitor for failover triggers. Enable link monitoring on critical interfaces (e.g., external and internal). Configure path monitoring by specifying target IPs (like the next-hop router) to ping. If a monitored interface or path fails, the active firewall will signal the passive to take over. Without monitoring, a silent failure (cable intact but router dead) will not trigger failover.
Set Preemptive Policy and Hold Timer
Decide whether you want the original active firewall to preempt and take back the active role after it recovers (preemptive yes) or let the current active stay (preemptive no). Set a hold-down timer (e.g., 30 seconds) to prevent flapping if the failure is brief. Commit the configuration on the active firewall and verify that the passive unit synchronises.
Test Failover
Perform a manual failover by selecting 'Make Passive' on the active unit from the GUI or CLI. Verify that the former passive unit becomes active and that traffic flows correctly. Test failback by repeating the process. Ensure that all critical services (internet access, VPN, internal routing) are functional after each transition. Document the test results.
An IT professional configuring active/passive HA for a mid-sized company typically follows a structured process. Suppose the company, called 'BrightStar Logistics', has 500 employees and uses a single Palo Alto PA-440 firewall at their headquarters. The firewall handles all internet traffic, site-to-site VPNs to branch offices, and remote access VPNs for employees working from home. One Friday afternoon, the firewall's power supply fails. The entire office loses internet. IT receives 50 calls in 10 minutes. The CEO is furious. The next Monday, the IT director approves a budget for a second PA-440 to set up active/passive HA.
The real-world steps start with physically racking both firewalls in the same data centre rack, side by side. The professional connects a dedicated crossover Ethernet cable between the HA1 ports on both units for heartbeat and configuration sync. They connect another dedicated cable between the HA2 ports for session synchronisation. They also connect a management interface on each firewall to the corporate network so they can log in from their desk. They then power on both firewalls, configure the basic management IP addresses, and log into the active firewall's web interface (Panorama or the local GUI). They navigate to Device > High Availability and enable HA. They set the first firewall's priority to 100 (lower number wins) and the second firewall's priority to 200. They configure the HA1 interface with IP 10.0.0.1/30 on the first firewall and 10.0.0.2/30 on the second. They do the same for HA2 using 10.0.1.1/30 and 10.0.1.2/30. They set preemptive to 'yes' with a hold-down timer of 30 seconds so that the original firewall does not flap (switch back and forth rapidly) if the failure was momentary.
The professional then configures the monitored interfaces. They select the external interface (ethernet1/1 connected to the internet router) and the internal interface (ethernet1/2 connected to the switch). They enable link monitoring for both, so if either cable is unplugged, a failover triggers. They also enable path monitoring by pinging the next-hop router's IP address (e.g., 192.168.1.1) from the external interface. If that router becomes unreachable, even if the cable is plugged in, the firewall knows the path is broken and initiates a failover.
Finally, they commit the configuration on the active firewall. The passive firewall automatically synchronises its configuration. They then perform a manual failover by clicking 'Make Passive' on the active unit. The passive unit becomes active within 5 seconds. They verify that all employees' internet connections work, that remote VPN users can reconnect, and that no sessions were disrupted. They then fail back to the original unit. The entire deployment takes about 2 hours.
The key actions an IT professional takes include:
Calculating the HA1 and HA2 subnet requirements (usually a /30 network to waste minimal IPs).
Ensuring both firewalls run the exact same PAN-OS version (a mismatch can prevent HA formation).
Verifying that all specific configuration objects (like Security rules, NAT policies, and decryption certificates) are correctly synchronised.
Testing failover during a change window (usually late at night or a weekend) when minimal users are active.
Documenting the HA pair's priority settings, preemption policy, and monitored interfaces so future administrators understand the behaviour.
Setting up SNMP or email alerts to notify the team when a failover occurs so they can investigate the root cause immediately.
Without HA, the company would experience unplanned downtime costing thousands of dollars per hour in lost productivity. With HA, a hardware failure becomes a non-event for users. The IT professional's job transitions from firefighting outages to proactively monitoring the health of the HA pair.
The PCNSE exam tests your understanding of active/passive HA in several specific ways. First, expect multiple-choice questions that ask you to identify which interface is used for heartbeat messages (HA1) versus session synchronisation (HA2). A common trap is that they will describe a scenario where heartbeats stop but session sync continues, and ask what happens. The correct answer is that a failover will trigger after the configured hold timeout because the passive unit detects no heartbeat, regardless of session sync status. Another trap is they will give you an HA pair with mismatched PAN-OS versions and ask why the pair does not form. You must know that both firewalls must run identical major and minor versions (e.g., both 10.1.x).
They also love to test the concept of preemptive versus non-preemptive failback. A typical exam question: 'An HA pair has preemptive enabled. The active firewall fails and the passive takes over. The original active comes back online 10 seconds later. What happens?' The answer is that the original active preempts and becomes active again after the hold-down timer expires, because it has a higher priority. A trap answer says the original stays passive, but that only happens if preemptive is disabled. You must memorise the default setting (non-preemptive) and when to change it.
Another frequently tested concept is the difference between link monitoring and path monitoring. Link monitoring only checks if the physical cable is plugged in and passing electrical signals. Path monitoring checks whether the firewall can reach a remote IP address (like a next-hop router). A question might say: 'The external interface cable is plugged in, but the ISP router is down. Link monitoring is configured. Does a failover occur?' The answer is no, because link monitoring only sees the cable condition, not the router's reachability. To trigger failover on a dead router, you must configure path monitoring.
The exam also tests your knowledge of session synchronisation limitations. Session synchronisation only works for TCP and UDP sessions. It does not synchronise sessions for protocols like GRE tunnels or IPsec VPNs in certain modes. A question may ask which sessions are lost during failover. The correct answer is that sessions using non-TCP/UDP protocols or multicast traffic may be dropped and need re-establishment. Additionally, you need to know that session synchronisation happens over the HA2 link, not HA1. HA1 only syncs configuration, not live session data.
You should also understand the concept of floating IP addresses (also called virtual IPs) in the context of HA. When a failover occurs, the passive unit assumes the IP addresses of the active unit on its interfaces. The network switches and routers see the same MAC addresses (if you enable gratuitous ARP) and traffic simply flows to the new active unit. A common question tests whether you need to reconfigure routing tables after failover. The answer is no, because the IP address moves with the active role.
Finally, the exam expects you to know the supported HA modes for the Palo Alto firewall: active/active is available only for specific models and has strict requirements for Layer 2 deployments. Active/passive is supported on all models and is the default recommendation. A frequent wrong answer is that active/active doubles throughput. It does not. It primarily provides redundancy, and throughput is limited by the active unit's capacity.
Key definitions to memorise:
HA1: control link for heartbeat and configuration sync.
HA2: data link for session and state synchronisation.
Floating IP: virtual IP that moves between firewalls during failover.
Preemptive: original active unit reclaims active role after recovery.
Non-preemptive: current active unit stays active after failover, even if original comes back.
Hold timeout: time the passive waits after losing heartbeat before declaring the active dead.
Monitor failure: an event that triggers failover, such as interface down or path unreachable.
Trap patterns include questions where the HA pair does not form because the HA1 IPs are in the same subnet as the management interface, or where the candidate thinks session sync occurs over HA1. Always answer based on the strict function of each link.
Active/passive HA uses one firewall to process traffic and a second synchronised firewall to take over immediately if the first fails, preventing network downtime.
The HA1 (control link) handles heartbeat messages and configuration synchronisation, while the HA2 (data link) handles session state synchronisation for live connections.
Failover is triggered by loss of heartbeat, interface link failures, or path monitoring failures, and the passive unit takes over within seconds after detecting the condition.
Preemptive mode causes the original active firewall to reclaim its role after recovery, while non-preemptive mode keeps the current active unit in place to avoid flapping.
Configuration changes must always be made on the active firewall and are automatically pushed to the passive unit; changes made on the passive unit are overwritten.
Licences and subscriptions must be purchased separately for each firewall in an HA pair; configuration and session data are the only items synchronised automatically.
These come up on the exam all the time. Here's how to tell them apart.
Active/Passive HA
Only one firewall processes traffic at a time.
Simpler to configure and troubleshoot.
Supports all deployment types (L2, L3, virtual wire).
Active/Active HA
Both firewalls process traffic simultaneously in Layer 2 mode.
More complex configuration with asymmetric routing risk.
Only supported on specific models and Layer 2 deployments.
HA1 (Control Link)
Carries heartbeat and configuration synchronisation data.
Required for HA pair formation and monitoring.
Low bandwidth requirements; can use 1 Gbps ports.
HA2 (Data Link)
Carries session state and application data synchronisation.
Required for stateful failover without session loss.
Higher bandwidth requirements; Palo Alto recommends 10 Gbps ports.
Preemptive Mode
Original active firewall reclaims active role after recovery.
Useful when the original unit has preferred hardware or location.
Requires hold-down timer to avoid flapping.
Non-Preemptive Mode
Current active firewall remains active after failover, even if original recovers.
Provides more stability by avoiding role changes for brief outages.
Default setting on Palo Alto firewalls.
Link Monitoring
Checks only the physical link state of an interface (up/down).
Triggers failover if the cable is unplugged or the port fails.
Does not verify that the device on the other end is reachable.
Path Monitoring
Checks reachability to a remote IP address by sending pings.
Triggers failover if the remote device (e.g., router) becomes unreachable.
Requires configuration of a target IP and source interface.
Session Synchronisation (TCP/UDP)
TCP and UDP session states are synchronised over HA2.
Failover preserves active TCP connections (e.g., web browsing, SSH).
Most common protocols in enterprise networks.
Session Synchronisation (Non-TCP/UDP)
Non-TCP/UDP protocols like GRE, ESP, and IPsec are NOT synchronised.
Failover drops these sessions; tunnels must be re-established.
Important to design with this limitation in mind.
Mistake
Active/passive HA doubles the network throughput because you have two firewalls.
Correct
Active/passive HA does not increase throughput. Only one firewall processes traffic at a time. The passive unit is idle until failover occurs. Throughput is limited to the capacity of a single firewall.
Beginners see two firewalls and assume the load is split. They confuse active/active (which can distribute load in Layer 2 mode) with active/passive (which does not).
Mistake
If I change the configuration on the passive firewall, it will sync to the active firewall automatically.
Correct
Configuration sync always flows from the active unit to the passive unit. Changes made on the passive unit are overwritten and lost upon the next sync. You must always make changes on the active firewall.
Users assume sync is bidirectional because they are used to file sync tools like Dropbox. Palo Alto HA is designed for one-directional sync to prevent conflicts.
Mistake
Session synchronisation over HA2 means all sessions are preserved perfectly after a failover, including encrypted VPN tunnels.
Correct
Session sync preserves TCP and UDP sessions. IPsec VPN tunnels, GRE tunnels, and other non-TCP/UDP protocols are not synchronised. Remote VPN users must re-establish their tunnels after failover.
Beginners think 'state synchronisation' means absolutely everything. They do not realise that session state for VPNs is handled separately and is not part of the HA2 sync.
Mistake
If the active firewall crashes, the passive firewall takes over instantly with zero packet loss.
Correct
There is a brief interruption (typically 2-10 seconds) during failover while the passive firewall detects the loss of heartbeat, promotes itself, and sends gratuitous ARP updates. Some packets in transit may be lost and need TCP retransmission.
Marketing materials often say 'seamless failover' which beginners interpret as 'no packets dropped'. In reality, there is a short disruption, and only TCP sessions with retransmission survive gracefully.
Mistake
Both firewalls in an HA pair must have the same serial number to work.
Correct
Serial numbers must be different. The HA pair uses unique serial numbers to identify each unit. They must also be the same model and have compatible PAN-OS versions, but serial numbers must differ.
This misconception arises because some people confuse 'identical hardware' with 'identical serial numbers.' Identical means same model and specs, but each physical unit has its own serial number.
Mistake
Licences purchased for one firewall automatically apply to the passive firewall in the HA pair.
Correct
Each firewall in an HA pair requires its own separate licences for subscriptions like Threat Prevention, URL Filtering, and WildFire. Licences are not shared or transferable between firewalls.
Beginners assume licences are per-pair because the configuration syncs. Palo Alto networks require per-device licensing. This is a common budget oversight during deployment.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
No, you must use separate physical cables for HA1 (control link) and HA2 (data link). They carry different types of traffic and using one cable would create a bottleneck and cause potential data loss.
If HA1 fails, heartbeats stop and the passive unit assumes the active is dead, triggering a failover after the hold timeout. HA2 alone cannot keep the pair stable because configuration sync and heartbeats rely on HA1.
Yes, each firewall needs its own management IP address so you can log in independently for troubleshooting. The management IP is not synchronised and each unit retains its own management interface configuration.
No, both firewalls must be the same hardware model and run the same PAN-OS version. For example, you cannot pair a PA-440 with a PA-450. They must be identical in hardware and software.
No, you can directly connect the HA1 and HA2 ports using crossover cables or straight-through cables with auto-MDIX. However, if the firewalls are physically far apart, you can use a switch in between, but that adds a potential point of failure.
No, remote VPN users must reconnect manually because IPsec VPN session state is not synchronised over HA2. Only TCP and UDP sessions are synchronised. Users will experience a brief interruption and need to reconnect their VPN client.
You've finished High Availability Configuration and Active/Passive Setup. Continue through the PCNSE study guide to build a complete picture of the exam.
Done with this chapter?