Troubleshooting HA Failover After PAN-OS Upgrade: Version Mismatch
A company has two Palo Alto Networks firewalls in an active/passive high availability pair. The firewalls are configured with a virtual IP (VIP) for the internal network. Recently, the passive firewall was upgraded to a new PAN-OS version. After the upgrade, the active firewall is still running the old version. The administrator wants to perform a failover to make the upgraded firewall active. However, when the administrator attempts to manually failover, the new passive firewall does not become active. The HA synchronization status shows 'synchronized' but the preemption is disabled. The administrator checks the HA configuration and finds that the peer's version is not compatible. What should the administrator do to successfully failover to the upgraded firewall?
Quick Answer
The correct answer, upgrading the active firewall to match the passive unit's new PAN-OS version, follows directly from how HA compatibility works: PAN-OS requires both members of an HA pair to run matching major versions to exchange configuration and heartbeat information reliably, and a version mismatch blocks failover regardless of what the synchronization status field reports. The scenario is designed to catch a common misreading, since 'synchronized' sounds like everything should be fine, but that field reflects whether the last successful configuration sync completed, not whether the two units are currently running compatible software. Once the passive firewall was upgraded independently, the pair became version-incompatible, and PAN-OS will not permit a firewall running an incompatible version to become active, which is why manual failover silently fails despite preemption being irrelevant here. Since traffic is still flowing through the active firewall on the old version, the only path forward that restores a valid HA relationship is bringing the active firewall up to the same version as its peer. Whenever a question shows an HA pair with mismatched versions after one unit was upgraded, and failover isn't behaving as expected, check version parity first, since a synchronized status alone doesn't guarantee the units are running compatible software.
⚠ Common exam trap
A common mix-up: candidates assume 'synchronized' status means HA is fully functional and failover will work, but they overlook that version compatibility is a prerequisite for stateful failover, not just configuration sync.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Upgrade the active firewall to the same PAN-OS version as the passive firewall
PAN-OS requires both firewalls in an active/passive HA pair to run the same major version to form a compatible HA connection. Even if synchronization status shows 'synchronized', the version mismatch prevents failover from succeeding. Upgrading the active firewall to match the passive firewall's version restores version compatibility and allows the failover to proceed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disable HA, then reconfigure HA on both firewalls
Why it's wrong here
This would cause unnecessary downtime and configuration loss.
- ✓
Upgrade the active firewall to the same PAN-OS version as the passive firewall
Why this is correct
Both firewalls must run the same version for proper HA operation; upgrading the active is the correct action.
- ✗
Force the failover via the CLI using 'request high-availability state suspend' on the active firewall
Why it's wrong here
This would suspend the active firewall but may cause split-brain or incompatibility issues.
- ✗
Downgrade the passive firewall back to the old version
Why it's wrong here
This defeats the purpose of upgrading and is not the best practice.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 504 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on PCNSE
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. In an active/passive HA pair, the passive firewall shows state 'non-functioning'. Both firewalls are running PAN-OS 10.1.5. What is the most likely cause?
hard- A.Heartbeat interface down
- ✓ B.Firmware version mismatch (one firewall is on 10.1.4)
- C.Management IP mismatch
- D.License mismatch
Why B: In an active/passive HA pair, both firewalls must run the same PAN-OS version to form a healthy HA connection. If one firewall is on 10.1.5 and the other on 10.1.4, the passive firewall will show a 'non-functioning' state because the HA configuration synchronization and keepalive mechanisms detect a version mismatch, preventing the HA pair from establishing correctly.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.