>
    Strata Copilot
    Recover HA State Machine
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma SD-WAN
    3. Prisma SD-WAN Administrator’s Guide
    4. Prisma SD-WAN ION Recovery and Debugging Mechanism
    5. Recover HA State Machine
    Download PDF
    Prisma SD-WAN

    Recover HA State Machine

    Table of Contents

    Recover HA State Machine

    Diagnose and recover a Prisma SD-WAN ION high-availability cluster where both devices are claiming the active role simultaneously.
    Where Can I Use This?What Do I Need?
    • Prisma SD-WAN (Managed by Strata Cloud Manager)
    • Prisma SD-WAN
    A split-brain condition occurs when both ION devices in an HA cluster simultaneously claim the active role, causing duplicate traffic flow. This typically results from VRRP advertisement drops on the HA link. Follow the steps below on both ION devices where possible to get the full picture of each device's HA state.
    1. Verify connectivity between the two ION HA ports by pinging across the HA link from one ION device to the other device's HA port IP.
    2. Run a tcpdump on the HA interface to check whether VRRP advertisements are being dropped. Replace <vlan-id> with the VLAN ID of your HA interface:
      tcpdump <vlan-id> args="-tttt -vv vrrp" show
      Healthy output for the target site and active ION device shows VRRP advertisements arriving at the configured interval. For example, if Advertisement Interval: 0.5 is set, expect a packet every 0.5 seconds from the peer. Gaps between expected advertisement timestamps indicate drops on the HA link.
    3. Check HA state, configuration, and failover history by running the following command:
      dump spoke-ha status
dump spoke-ha config
dump spoke-ha failover-timeline json
      In dump spoke-ha status, confirm Peer Connected: true and Active: true on the intended primary ION only. If both ION devices show Active: true, or both show Active: false, this confirms a split-brain condition. In the failover timeline, note when role changes occurred to identify what triggered the split.
    4. Verify the HAM (HA state machine) process is running and has not restarted unexpectedly:
      debug process status name=ham
      Expected output shows RUNNING with a stable uptime. A recent restart timestamp or a STOPPED state indicates a process-level issue requiring escalation.
    5. Contact Palo Alto Networks support with the output from all the commands above.

    © 2026 Palo Alto Networks, Inc. All rights reserved.