>
    HA Firewall States
    Focus
    Download PDF
    Focus
    1. Home
    2. PAN-OS
    3. High Availability
    4. HA Firewall States
    Download PDF

    HA Firewall States

    Table of Contents

    HA Firewall States

    An HA firewall can be in one of the following states:
    HA Firewall State
    Occurs In
    Description
    Initial
    A/P or A/A
    Transient state of a firewall when it joins the HA pair. The firewall remains in this state after boot-up until it discovers a peer and negotiations begins. After a timeout, the firewall becomes active if HA negotiation has not started.
    Active
    A/P
    State of the active firewall in an active/passive configuration.
    Passive
    A/P
    State of the passive firewall in an active/passive configuration. The passive firewall is ready to become the active firewall with no disruption to the network. Although the passive firewall is not processing other traffic:
    • If passive link state auto is configured, the passive firewall is running routing protocols, monitoring link and path state, and the passive firewall will pre-negotiate LACP and LLDP if LACP and LLDP pre-negotiation are configured, respectively.
    • The passive firewall is synchronizing flow state, runtime objects, and configuration.
    • The passive firewall is monitoring the status of the active firewall using the hello protocol.
    Active-Primary
    A/A
    In an active/active configuration, state of the firewall that connects to User-ID agents, runs DHCP server and DHCP relay, and matches NAT and PBF rules with the Device ID of the active-primary firewall. A firewall in this state can own sessions and set up sessions.
    Active-Secondary
    A/A
    In an active/active configuration, state of the firewall that connects to User-ID agents, runs DHCP server, and matches NAT and PBF rules with the Device ID of the active-secondary firewall. A firewall in active-secondary state does not support DHCP relay. A firewall in this state can own sessions and set up sessions.
    Tentative
    A/A
    State of a firewall (in an active/active configuration) caused by one of the following:
    • Failure of a firewall.
    • Failure of a monitored object (a link or path).
    • The firewall leaves suspended or non-functional state.
    A firewall in tentative state synchronizes sessions and configurations from the peer.
    • In a virtual wire deployment, when a firewall enters tentative state due to a path failure and receives a packet to forward, it sends the packet to the peer firewall over the HA3 link for processing. The peer firewall processes the packet and sends it back over the HA3 link to the firewall to be sent out the egress interface. This behavior preserves the forwarding path in a virtual wire deployment.
    • In a Layer 3 deployment, when a firewall in tentative state receives a packet, it sends that packet over the HA3 link for the peer firewall to own or set up the session. Depending on the network topology, this firewall either sends the packet out to the destination or sends it back to the peer in tentative state for forwarding.
    After the failed path or link clears or as a failed firewall transitions from tentative state to active-secondary state, the Tentative Hold Time is triggered and routing convergence occurs. The firewall attempts to build routing adjacencies and populate its route table before processing any packets. Without this timer, the recovering firewall would enter active-secondary state immediately and would silently discard packets because it would not have the necessary routes.
    When a firewall leaves suspended state, it goes into tentative state for the Tentative Hold Time after links are up and able to process incoming packets.
    Tentative Hold Time range (sec) can be disabled (which is 0 seconds) or in the range 10-600; default is 60.
    Non-functional
    A/P or A/A
    Error state due to a dataplane failure or a configuration mismatch, such as only one firewall configured for packet forwarding, VR sync or QoS sync.
    In active/passive mode, all of the causes listed for Tentative state cause non-functional state.
    Suspended
    A/P or A/A
    The device is disabled so won’t pass data traffic and although HA communications still occur, the device doesn’t participate in the HA election process. It can’t move to an HA functional state without user intervention.

    © 2024 Palo Alto Networks, Inc. All rights reserved.