Resolving Configuration Mismatch in Palo Alto HA Pair
In an Active/Passive HA pair, the passive firewall reports 'non-functional' state. The 'show high-availability state' output on the passive shows 'state: non-functional' and 'reason: configuration mismatch'. The active firewall shows 'state: active' and 'reason: no reason'. Which action should be taken to resolve the issue without disrupting traffic?
Quick Answer
The correct action, running 'request high-availability sync-to-remote' from the active firewall, is correct because it directly addresses what the reported reason actually says: 'configuration mismatch,' which means the two firewalls' configuration databases have diverged rather than there being any hardware, session, or version-level problem. The active firewall is confirmed healthy with 'no reason' listed, so the fix only needs to move configuration in one direction, from the known-good active unit to the passive unit that has fallen out of sync. This command specifically pushes the active configuration to the peer without forcing a failover, a reboot, or any interruption to the traffic the active firewall is currently handling, which is exactly what the requirement to resolve the issue 'without disrupting traffic' calls for. It's worth contrasting this with more disruptive fixes like manually rebooting the passive unit or forcing a failover, which might eventually resolve a mismatch but at the cost of unnecessary risk or downtime when a targeted sync command achieves the same result more safely. Whenever an HA state reason explicitly names a configuration mismatch rather than a version or connectivity problem, look for the least disruptive synchronization command that pushes the active configuration outward, rather than a broader corrective action.
⚠ Common exam trap
Many exam-takers assume a 'non-functional' state requires a restart or failover, but the specific 'configuration mismatch' reason points to a sync issue that can be resolved non-disruptively with a configuration push from the active firewall.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Run 'request high-availability sync-to-remote' from the active firewall
The 'configuration mismatch' error indicates that the configuration databases on the active and passive firewalls are out of sync. Running 'request high-availability sync-to-remote' from the active firewall pushes the active configuration to the passive firewall without disrupting traffic, as it only updates the passive unit's configuration and does not trigger a failover or restart.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Run 'request high-availability sync-to-remote' from the active firewall
Why this is correct
This synchronizes the active configuration to the passive without downtime.
- ✗
Restart the HA process on the passive firewall with 'debug software restart high-availability'
Why it's wrong here
Restart does not fix config mismatch.
- ✗
Failover the active firewall to force re-sync
Why it's wrong here
Failover would cause traffic disruption.
- ✗
Upgrade both firewalls to the same PAN-OS version
Why it's wrong here
Versions are likely same; mismatch is config, not version.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 504 original PCNSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on PCNSE
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has two Palo Alto Networks firewalls configured in active/passive HA. During a failover test, the passive firewall becomes active but traffic is not passing. The active firewall shows the correct configuration and licenses. Which action is most likely to resolve the issue?
medium- A.Enable preemption on the HA configuration.
- B.Re-apply the licenses on the newly active firewall.
- ✓ C.Perform a configuration synchronization from the original active firewall.
- D.Disable the HA2 link to force stateful failover.
Why C: The most likely cause of traffic failure after a failover is that the configuration on the newly active firewall is out of sync with the original active firewall. In active/passive HA, configuration synchronization (config sync) is typically enabled, but if it was not performed before the failover or if the passive device had a stale configuration, critical settings such as interface IPs, security policies, or routing entries may be missing or incorrect. Performing a configuration synchronization from the original active firewall ensures the new active device has the exact same configuration, restoring traffic flow.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.