HA Links and Backup Links
Ports on the SMC
Speed: Ethernet 10/100/1000
Used for HA control and synchronization in both HA Modes. Connect this port directly from the HA1-A port on the first firewall to the HA1-A port on the second firewall in the pair, or connect them through a switch or router.
HA1 cannot be configured on NPC data ports or the MGT port.
Control Link Backup
Speed: Ethernet 10/100/1000 port
Used for HA control and synchronization as a backup for HA1-A in both HA Modes. Connect this port directly from the HA1-B port on the first firewall to the HA1-B port on the second firewall in the pair, or connect them through a switch or router.
HA1 Backup cannot be configured on NPC data ports or the MGT port.
Data Link Backup
The High Speed Chassis Interconnect (HSCI) ports are Layer 1 Quad Port SFP+ (QSFP+) interfaces used to connect two PA-7000 Series firewalls in an HA configuration. Each port is comprised of four 10 gigabit channels multiplexed for a combined speed of 40 gigabits.
The traffic carried on the HSCI ports is raw layer-1, which is not routable or switchable; therefore the HSCI ports must be connected directly to each other. The HSCI-A on the first chassis connects directly to HSCI-A on the second chassis and HSCI-B on the first chassis connects to HSCI-B on the second chassis. This provides full 80 gigabit transfer rates. In software, both ports (HSCI-A and HSCI-B) are treated as one HA interface.
Palo Alto Networks recommends using the dedicated HSCI ports for the HA2 link. The HA3 link, required for packet forwarding in an active/active deployment, must use the HSCI port; the HA3 traffic cannot be configured on data ports.
If the firewalls are deployed in: