PCNSA Device Management and Services Practice Question
A company has two Palo Alto Networks firewalls in an active/passive HA pair (PA-5250) running PAN-OS 10.1. The HA configuration uses dedicated HA1 (control link) and HA2 (data link) interfaces. The network team recently replaced a failed switch that connected the HA1 interfaces. After the switch replacement, the HA pair is not forming. The administrator logs into the active firewall and runs 'show high-availability state' which shows the local state as 'active' and the peer state as 'unknown'. The HA1 interface status shows 'link down'. The administrator checks the physical connections and confirms the cables are connected and the switch ports are up. What is the most likely cause and the best course of action?
⚠ Common exam trap
Many exam-takers assume 'link down' always means a physical cable issue, but in PAN-OS HA, it can also indicate a Layer 2 misconfiguration on the switch (e.g., VLAN mismatch or port mode), and the correct first step is to verify Layer 2 and Layer 3 connectivity rather than checking HA2 or enabling nonexistent features.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Verify that the HA1 interfaces are on the same VLAN and can ping each other using the configured HA1 IP addresses
The HA1 interfaces must be on the same Layer 2 domain (VLAN) and able to communicate via ICMP to form the control link. The 'link down' status on the HA1 interface, despite physical connectivity, indicates a Layer 2 misconfiguration (e.g., VLAN mismatch or port mode issue) on the replaced switch. Verifying that the HA1 IP addresses can ping each other confirms Layer 3 reachability, which is essential for HA1 heartbeats and state synchronization.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Ensure that the HA2 interfaces are also connected and configured correctly
Why it's wrong here
HA2 is for data synchronization, not for control plane communication. HA formation relies on HA1.
- ✗
Change the HA2 IP addresses to be on the same subnet as HA1
Why it's wrong here
HA1 and HA2 should be on different subnets to avoid conflicts.
- ✗
Enable HA ping on the HA1 interface to test connectivity
Why it's wrong here
HA ping is a monitoring feature, not a prerequisite for HA formation.
- ✓
Verify that the HA1 interfaces are on the same VLAN and can ping each other using the configured HA1 IP addresses
Why this is correct
HA1 interfaces must have layer 3 connectivity. A switch replacement may have changed VLAN assignments, breaking the link.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 516 original PCNSA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.