PCNSE Deploy and Configure Firewalls Practice Question
A company has deployed a Palo Alto Networks firewall in an active/passive high-availability (HA) pair. The firewall uses BGP for dynamic routing with two upstream ISPs to provide load-balanced internet connectivity. After an HA failover event, the network team notices that outbound traffic from internal hosts is now using only one of the two ISPs, even though BGP sessions are established on both firewalls and the passive firewall has learned the same routes as the active one. The security policy permits all outbound traffic. No changes were made to the BGP configuration. Which of the following is the most likely cause of this behavior, and what is the appropriate solution?
⚠ Common exam trap
Candidates often assume BGP sessions being established and routes being learned automatically results in load balancing, but PAN-OS requires explicit ECMP enablement in the dataplane to use multiple equal-cost paths for forwarding.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The HA configuration has ECMP disabled; enable ECMP in the dataplane settings on the active firewall.
B is correct because in an active/passive HA pair, ECMP (Equal-Cost Multi-Path) is disabled by default on the dataplane. Even though BGP sessions are established and routes are learned, the active firewall will only install a single best path per prefix unless ECMP is explicitly enabled in the dataplane settings. This causes outbound traffic to use only one ISP after failover, as the firewall is not load-balancing across the two equal-cost BGP routes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The firewall's asymmetric routing detection is dropping traffic; disable asymmetric routing enforcement.
Why it's wrong here
Asymmetric routing detection affects return traffic, not outbound path selection.
- ✓
The HA configuration has ECMP disabled; enable ECMP in the dataplane settings on the active firewall.
Why this is correct
ECMP allows the firewall to use multiple equal-cost routes for load balancing; it must be enabled.
- ✗
The BGP configuration on the passive firewall is not identical to the active one; apply the same BGP configuration to both.
Why it's wrong here
The passive firewall's BGP config does not impact the active firewall's routing table.
- ✗
The passive firewall is not advertising routes to the ISPs because HA state synchronization is not enabled; enable state synchronization.
Why it's wrong here
State sync does not affect route advertisement; BGP peers on the passive firewall are independent.
Go deeper
Related to this question
About these practice questions
One of 504 original PCNSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.