HA Passive Firewall Non-Functional Due to PAN-OS Version Mismatch
A firewall is deployed in an Active/Passive HA pair. The administrator notices that the passive firewall is not synchronizing configuration changes. The 'show high-availability state' command shows the passive firewall in a 'non-functional' state. What is the most likely cause?
Quick Answer
The correct answer is a PAN-OS version mismatch because HA synchronization depends on both firewalls speaking the exact same configuration schema, and a version difference breaks that assumption at the most basic level. When the passive firewall runs different software than the active unit, it cannot reliably parse or apply configuration pushed from its peer, so instead of silently failing partway through, PAN-OS marks the unit 'non-functional' to prevent it from ever taking over in a broken or inconsistent state. This is a deliberate safeguard: an HA pair's entire value proposition is that the passive unit can become active instantly and behave identically to the unit it replaces, which is only guaranteed if both run identical software. A mismatch here is distinct from other HA problems like link failures or configuration sync being merely out of date, both of which usually surface with different state reasons rather than 'non-functional.' The pattern to watch for on future questions: whenever an HA pair shows a passive unit that is failing to synchronize or is stuck in a non-functional state, check version alignment before assuming a networking or configuration content issue, since PAN-OS treats software version parity as a prerequisite for HA to function at all.
⚠ Common exam trap
Many candidates confuse 'non-functional' with connectivity issues (like a down HA link) or session sync settings, but the key is that configuration sync requires identical PAN-OS versions, and a mismatch manifests as a 'non-functional' state on the passive firewall.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The passive firewall is running a different PAN-OS version
The passive firewall showing a 'non-functional' state in an Active/Passive HA pair most likely indicates a version mismatch. PAN-OS requires both firewalls in an HA pair to run the exact same software version for configuration synchronization to work. If the passive firewall is running a different PAN-OS version, it cannot properly interpret or apply the configuration from the active firewall, causing it to enter a non-functional state.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The HA2 link is down but HA1 is up
Why it's wrong here
HA2 down would cause session sync issues, not non-functional state.
- ✗
The session sync is disabled
Why it's wrong here
Session sync is separate from config sync.
- ✗
The passive firewall has link monitoring enabled
Why it's wrong here
Link monitoring does not cause non-functional state.
- ✓
The passive firewall is running a different PAN-OS version
Why this is correct
Version mismatch causes non-functional state.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 504 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on PCNSE
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Refer to the exhibit. The firewall is active in an HA pair, but the peer is non-functional. The HA2 link is down. What is the most likely cause of the peer being non-functional?
hard- A.The HA3 link is down
- B.The HA2 link is down, preventing session synchronization
- ✓ C.The peer firewall is running a different PAN-OS version
- D.The HA1 link is down
Why C: When an HA pair detects a version mismatch between peers, the firewall with the higher PAN-OS version will not form an active/passive HA state and will remain non-functional (or in a 'non-functional' state) to prevent configuration or session incompatibilities. The HA2 link being down is a separate issue that affects session synchronization but does not cause the peer to be completely non-functional; the peer can still operate with reduced HA capabilities. A version mismatch is a critical condition that prevents HA peering entirely, leading to one peer appearing non-functional.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.