The answer is to configure a policy that sends a small amount of traffic through each VXLAN tunnel to trigger tunnel establishment on the new active firewall. This is correct because Palo Alto Networks firewalls build VXLAN tunnels dynamically based on data-plane traffic, not statically from the configuration sync. After an active/passive HA failover, the new active firewall receives the VXLAN configuration via HA2 but does not automatically rebuild the tunnel endpoints; it requires actual traffic to initiate the VXLAN tunnel setup, populating the show vxlan tunnel output and restoring forwarding for VXLAN-terminated VLANs. On the PCNSE exam, this scenario tests your understanding of VXLAN tunnel failover behavior in active/passive HA, a common trap where engineers assume configuration sync alone rebuilds tunnels. Remember: VXLAN tunnels are traffic-triggered, not config-triggered. A useful memory tip is “traffic builds the bridge”—without a data-plane packet, the tunnel stays empty on the new active firewall.
PCNSE Practice Question: Managing Troubleshooting and High Availability
This PCNSE practice question tests your understanding of managing troubleshooting and high availability. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A large enterprise uses an active/passive HA pair of PA-5250 firewalls to secure their data center. The network team recently migrated from a flat network to a VXLAN-based overlay. After the migration, they notice that during failover tests, the new active firewall does not forward traffic for VXLAN-terminated VLANs, even though the physical interfaces are up and the HA state transitions correctly. The configuration uses subinterfaces on Ethernet1/1 for each VLAN, with VXLAN tunnel termination on the firewall. The passive firewall receives the configuration sync, but show vxlan tunnel shows no VXLAN tunnels on the new active firewall after failover. The sessions are synced via HA2. The ARP table is correct. Which course of action should the engineer take to resolve the issue?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure a policy to send a small amount of traffic through each VXLAN tunnel to trigger tunnel establishment on the new active firewall.
Option D is correct because VXLAN tunnels on Palo Alto Networks firewalls are dynamically established based on data-plane traffic. After a failover, the new active firewall does not automatically rebuild the tunnels; it requires traffic to trigger the tunnel establishment. Sending a small amount of traffic through each VXLAN tunnel forces the firewall to initiate the VXLAN tunnel setup, populating the 'show vxlan tunnel' output and restoring traffic forwarding.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Add static routes for the VXLAN tunnel endpoints on the passive firewall.
Why it's wrong here
The routes are already synced; the issue is tunnel state.
✗
Enable VXLAN tunnel synchronization under HA setup.
Why it's wrong here
There is no such feature; VXLAN tunnels are not synced.
✗
Reboot the new active firewall to reload the VXLAN configuration.
Why it's wrong here
Rebooting will not help as the configuration is already there; the tunnel state is the issue.
✓
Configure a policy to send a small amount of traffic through each VXLAN tunnel to trigger tunnel establishment on the new active firewall.
Why this is correct
This will cause the firewall to re-establish the VXLAN tunnels dynamically.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates assume configuration sync includes dynamic tunnel state, but Palo Alto Networks firewalls do not synchronize VXLAN tunnel state across HA peers, requiring traffic to trigger tunnel establishment on the new active firewall.
Detailed technical explanation
How to think about this question
VXLAN tunnels on Palo Alto Networks firewalls are created dynamically when the firewall receives traffic destined for a VXLAN segment and the tunnel endpoint is reachable. The 'show vxlan tunnel' command displays only active tunnels; after a failover, the new active firewall must re-learn the tunnel endpoints via ARP and then establish tunnels on-demand. In real-world scenarios, this behavior prevents stale tunnels but requires careful planning for failover testing to ensure traffic generators or monitoring tools trigger tunnel creation.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A help-desk technician troubleshoots why a newly connected PC cannot reach shared printers on the same floor. The cable is good, the switch port is active, but the PC is in VLAN 20 and the printers are in VLAN 10. The uplink trunk only allows VLAN 10. A trunk being up does not mean every VLAN crosses it.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Managing Troubleshooting and High Availability — This question tests Managing Troubleshooting and High Availability — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Configure a policy to send a small amount of traffic through each VXLAN tunnel to trigger tunnel establishment on the new active firewall. — Option D is correct because VXLAN tunnels on Palo Alto Networks firewalls are dynamically established based on data-plane traffic. After a failover, the new active firewall does not automatically rebuild the tunnels; it requires traffic to trigger the tunnel establishment. Sending a small amount of traffic through each VXLAN tunnel forces the firewall to initiate the VXLAN tunnel setup, populating the 'show vxlan tunnel' output and restoring traffic forwarding.
What should I do if I get this PCNSE question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.