What Settings Don’t Sync in Active/Active HA?
Table of Contents
Expand All
|
Collapse All
Next-Generation Firewall Docs
-
-
- Cloud Management of NGFWs
- PAN-OS 10.0 (EoL)
- PAN-OS 10.1
- PAN-OS 10.2
- PAN-OS 11.0
- PAN-OS 11.1
- PAN-OS 9.1
-
- PAN-OS 10.1
- PAN-OS 10.2
- PAN-OS 11.0
- PAN-OS 11.1
-
-
-
- Cloud Management and AIOps for NGFW
- PAN-OS 10.0 (EoL)
- PAN-OS 10.1
- PAN-OS 10.2
- PAN-OS 11.0
- PAN-OS 11.1
- PAN-OS 8.1 (EoL)
- PAN-OS 9.0 (EoL)
- PAN-OS 9.1
End-of-Life (EoL)
What Settings Don’t Sync in Active/Active HA?
You must configure the following settings on each firewall
in an HA pair in an active/active deployment. These settings do
not sync from one peer to another.
Configuration Item | What Doesn’t Sync
in Active/Active? |
---|---|
Management Interface Settings | You must configure all management settings
individually on each firewall, including:
|
Multi-vsys Capability | You must activate the Virtual Systems license
on each firewall in the pair to increase the number of virtual systems
beyond the base number provided by default on PA-3200 Series, PA-5200
Series, and PA-7000 Series firewalls. You must also enable Multi
Virtual System Capability on each firewall (Device Setup Management General Settings |
Panorama Settings | Set the following Panorama settings on each
firewall ( Device Setup Management Panorama Settings
|
SNMP | Device Setup Operations SNMP Setup |
Services | Device Setup Services |
Global Service Routes | Device Setup Services Service
Route Configuration |
Telemetry and Threat Intelligence Settings | Device Setup Telemetry and Threat Intelligence |
Data Protection | Device Setup Content-ID Manage Data Protection |
Jumbo Frames | Device Setup Session Session
Settings Enable Jumbo Frame |
Packet Buffer Protection | Device Setup Session Session
Settings Packet Buffer Protection Network Zones Enable
Packet Buffer Protection |
Forward Proxy Server Certificate Settings | Device Setup Session Decryption
Settings SSL Forward Proxy Settings |
HSM Configuration | Device Setup HSM |
Log Export Settings | Device Scheduled Log Export |
Software Updates | With software updates, you can either download
and install them separately on each firewall, or download them on
one peer and sync the update to the other peer. You must install
the update on each peer ( Device Software |
GlobalProtect Agent Package | With GlobalProtect app updates, you can
either download and install them separately on each firewall, or
download them to one peer and sync the update to the other peer.
You must activate separately on each peer ( Device GlobalProtect Client |
Content Updates | With content updates, you can either download
and install them separately on each firewall, or download them on
one peer and sync the update to the other peer. You must install
the update on each peer ( Device Dynamic Updates |
Licenses/Subscriptions | Device Licenses |
Support Subscription | Device Support |
Ethernet Interface IP Addresses | All Ethernet interface configuration settings
sync except for the IP address ( Network Interface Ethernet |
Loopback Interface IP Addresses | All Loopback interface configuration settings
sync except for the IP address ( Network Interface Loopback |
Tunnel Interface IP Addresses | All Tunnel interface configuration settings
sync except for the IP address ( Network Interface Tunnel |
LACP System Priority | Each peer must have a unique LACP System
ID in an active/active deployment ( Network Interface Ethernet Add Aggregate Group System Priority |
VLAN Interface IP Address | All VLAN interface configuration settings
sync except for the IP address ( Network Interface VLAN |
Virtual Routers | Virtual router configuration synchronizes
only if you have enabled VR Sync ( Device High Availability Active/Active Config Packet Forwarding |
IPSec Tunnels | IPSec tunnel configuration synchronization
is dependent on whether you have configured the Virtual Addresses
to use Floating IP addresses ( Device High Availability Active/Active Config Virtual Address |
GlobalProtect Portal Configuration | GlobalProtect portal configuration synchronization
is dependent on whether you have configured the Virtual Addresses
to use Floating IP addresses ( Network GlobalProtect Portals |
GlobalProtect Gateway Configuration | GlobalProtect gateway configuration synchronization
is dependent on whether you have configured the Virtual Addresses
to use Floating IP addresses ( Network GlobalProtect Gateways |
QoS | QoS configuration synchronizes only if you
have enabled QoS Sync (Device High Availability Active/Active Config Packet Forwarding |
LLDP | No LLDP state or individual firewall data
is synchronized in an active/active configuration ( Network Network Profiles LLDP |
BFD | No BFD configuration or BFD session data
is synchronized in an active/active configuration ( Network Network Profiles BFD Profile |
IKE Gateways | IKE gateway configuration synchronization
is dependent on whether you have configured the Virtual Addresses
to use floating IP addresses ( Network IKE Gateways |
Master Key | The master key must be identical on each
firewall in the HA pair, but you must manually enter it on each
firewall ( Device Master
Key and Diagnostics Before changing
the master key, you must disable config sync on both peers ( Device High Availability General Setup Enable Config Sync check box) and
then re-enable it after you change the keys. |
Reports, logs, and Dashboard Settings | Log data, reports, and dashboard data and
settings (column display, widgets) are not synced between peers.
Report configuration settings, however, are synced. |
HA settings |
|
Rule Usage Data | Rule usage data, such as hit count, Created,
and Modified Dates, are not synced between peers. You need to log
in to the each firewall to view the policy rule hit count data for
each firewall or use Panorama to view information on the HA firewall
peers. |
Certificates for Device Management and Syslog Communication
over SSL only | Device Certificate Management Certificates Certificates
used for device management or for syslog communication over SSL
don’t synchronize with an HA peer. |
Certificates in a Certificate Profile | Device Certificate Management Certificate Profile |
SSL/TLS Service Profile for Device Management only | Device Certificate Management SSL/TLS
Service Profile SSL/TLS Service
Profile for Device Management doesn’t synchronize with an HA peer. |
Device-ID and IoT Security | IP address-to-device mappings and policy
rule recommendations don’t synchronize with an HA peer. |