Why the Default Route Disappears After HA Failover and How to Fix It
An engineer notices that after an HA failover, the new active firewall is not passing traffic. The show running ip route command shows the default route is missing. What is the most likely cause?
Quick Answer
The answer is that floating static routes were not configured on the passive firewall. This is correct because in an active/passive HA pair, static routes are not automatically synchronized from the active to the passive firewall; the passive unit must have its own static routes pre-configured, typically as floating static routes with a higher administrative distance to prevent conflicts during normal operation. When a failover occurs, the new active firewall—formerly passive—lacks the default route, causing traffic to fail. On the PCNSE exam, this scenario tests your understanding of HA route synchronization limitations and the distinction between dynamic and static route propagation. A common trap is assuming that all configurations, including static routes, are mirrored automatically. Remember the memory tip: “Passive needs its own path—floating routes prevent the crash.”
⚠ Common exam trap
Candidates often assume all routes are synchronized in HA, but PAN-OS only synchronizes dynamic routing protocol states and not static route configuration, requiring explicit configuration on both peers.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Floating static routes were not configured on the passive firewall.
In an active/passive HA pair, static routes are not automatically synchronized from the active to the passive firewall. The passive firewall must have its own static routes configured, often as floating static routes with a higher administrative distance to avoid conflicts during normal operation. When a failover occurs, the new active firewall (formerly passive) lacks the default route because it was never configured or synchronized, causing traffic to fail.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Floating static routes were not configured on the passive firewall.
Why this is correct
Floating static routes are not synchronized and must be configured on both firewalls.
- ✗
Static routes were not synchronized.
Why it's wrong here
Static routes are synchronized via HA.
- ✗
OSPF routes were not synchronized.
Why it's wrong here
OSPF routes are synchronized via HA.
- ✗
BGP routes were not synchronized.
Why it's wrong here
BGP routes are synchronized via HA.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 504 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on PCNSE
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has two Palo Alto Networks firewalls configured in an active/passive HA pair. During a failover test, the passive firewall becomes active, but traffic stops passing through the new active firewall. The management interface on the new active firewall is reachable. What is the most likely cause?
hard- A.The ARP table was not synchronized during failover.
- B.The HA2 link is down, causing session table mismatch.
- C.The new active firewall does not have a valid license.
- ✓ D.The session setup rate exceeded the new active firewall's capacity.
Why D: When a passive firewall becomes active, it must process all new session setups from scratch. If the session setup rate exceeds the new active firewall's capacity (e.g., due to licensing limits on session count or throughput), traffic will be dropped even though the management interface remains reachable. The management plane is separate from the data plane, so management access can still work while forwarding fails.
Variation 2. A company has two Palo Alto Networks firewalls configured in active/passive HA. During a failover test, the passive firewall becomes active but traffic is not passing. The active firewall shows the correct configuration and licenses. Which action is most likely to resolve the issue?
medium- A.Enable preemption on the HA configuration.
- B.Re-apply the licenses on the newly active firewall.
- ✓ C.Perform a configuration synchronization from the original active firewall.
- D.Disable the HA2 link to force stateful failover.
Why C: The most likely cause of traffic failure after a failover is that the configuration on the newly active firewall is out of sync with the original active firewall. In active/passive HA, configuration synchronization (config sync) is typically enabled, but if it was not performed before the failover or if the passive device had a stale configuration, critical settings such as interface IPs, security policies, or routing entries may be missing or incorrect. Performing a configuration synchronization from the original active firewall ensures the new active device has the exact same configuration, restoring traffic flow.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.