Passive Firewall Non-Functional: HA1 Link Down
A company has deployed two PA-5250 firewalls in an active/passive high-availability pair. The passive firewall shows the status 'non-functional' after a reboot. The active firewall is still passing traffic. The administrator checks the HA configuration and sees that the preemptive setting is enabled on both firewalls. What is the most likely cause of the passive firewall showing 'non-functional'?
Quick Answer
The answer is that the management port (MGT) on the passive firewall is down or unplugged. On the PA-5250, the MGT port serves double duty: it provides out-of-band management access and, critically, carries the HA1 control link heartbeat in many high-availability deployments. If that port is physically disconnected or fails after a reboot, the passive firewall cannot send or receive the HA1 keepalive packets, so it reports as 'non-functional' even though the active unit continues passing traffic normally. The preemptive setting is a red herring here—it only controls whether a device reclaims its role after a failover, not the initial functional status after a reboot. On the PCNSE exam, this scenario tests your understanding of HA link dependencies and the specific hardware role of the MGT port on chassis-based models like the PA-5200 series. A common trap is to blame preemption or HA2 synchronization, but the real culprit is always a broken control link. Memory tip: think of the MGT port as the “heartbeat wire”—if it’s unplugged, the passive firewall flatlines.
⚠ Common exam trap
Candidates may incorrectly assume that the management port (MGT) is involved in HA, but the root cause of a non-functional passive state is typically a configuration mismatch such as the hello interval, not a physical link issue on the management interface.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The hello interval on the passive firewall is set to a different value than on the active firewall.
The passive firewall reports 'non-functional' after a reboot if it cannot establish an HA1 control link with the active firewall. The most likely cause in this scenario is a mismatch in the hello interval between the two firewalls, which prevents the HA pair from forming. The preemptive setting does not affect the initial functional status; it only influences role preemption after a failover. The management port (MGT) is not used for HA1 in default deployments and its status would not impact HA functionality unless explicitly configured as an HA1 backup.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The preemptive setting is causing the passive firewall to remain in non-functional state until a failover occurs.
Why it's wrong here
The preemptive setting does not cause the passive firewall to remain in a non-functional state; it only determines whether a higher-priority device will take over after a failover.
- ✗
The HA2 keepalive timer has expired.
Why it's wrong here
The HA2 keepalive timer is used for session synchronization; its expiration affects data plane synchronization but does not directly cause the passive to show as 'non-functional'.
- ✗
The management port (MGT) on the passive firewall is down or unplugged.
Why it's wrong here
The management port (MGT) is not part of the HA control link in default deployments, so its status does not affect HA functional state.
- ✓
The hello interval on the passive firewall is set to a different value than on the active firewall.
Why this is correct
A mismatch in hello intervals between the active and passive firewalls prevents the HA pair from forming, leaving the passive in a non-functional state after a reboot.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 504 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on PCNSE
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is deploying a new firewall in active/passive high availability. The two firewalls are connected directly via the HA1 and HA2 interfaces. After configuration, the passive firewall shows 'HA state: passive' but the active firewall shows 'HA state: non-functional'. What is the most likely cause?
medium- A.The HA1 link is down or misconfigured.
- B.The HA2 link is being used for management traffic.
- C.The preemptive setting is enabled on both firewalls.
- ✓ D.The HA2 link is down or misconfigured.
Why D: In active/passive HA, the HA2 link is used for session synchronization and state propagation. If the HA2 link is down or misconfigured, the active firewall cannot synchronize session state to the passive unit, causing it to report 'non-functional' even though the passive unit sees itself as 'passive'. The HA1 link handles heartbeats and configuration sync, which may still be operational, but without a functional HA2 link, the HA pair cannot maintain proper state synchronization, leading to the active firewall's non-functional state.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.