End-of-Life (EoL)
What Settings Don’t Sync in Active/Active HA?
You must configure the following settings on each firewall
in an HA pair in an active/active deployment. These settings do
not sync from one peer to another.
Configuration Item | What Doesn’t Sync
in Active/Active? |
---|---|
Management Interface Settings | You must configure all management settings
individually on each firewall, including:
|
Multi-vsys Capability | You must activate the Virtual Systems license
on each firewall in the pair to increase the number of virtual systems
beyond the base number provided by default on PA-3000 Series, PA-4000
Series, PA-5000 Series, and PA-7000 Series firewalls. You
must also enable Multi Virtual System Capability on
each firewall (Device Setup Management General Settings |
Panorama Settings | Set the following Panorama settings on each
firewall ( Device Setup Management Panorama Settings
|
SNMP |
|
Statistics Collection |
|
Services |
|
Global Service Routes |
|
Data Protection |
|
Jumbo Frames |
|
Forward Proxy Server Certificate Settings |
|
HSM Configuration |
|
Log Export Settings |
|
Software Updates | With software updates, you can either download
and install them separately on each firewall, or download them on
one peer and sync the update to the other peer. You must install
the update on each peer.
|
GlobalProtect Agent Package | With GlobalProtect client updates, you can
either download and install them separately on each firewall, or
download them to one peer and sync the update to the other peer.
You must activate separately on each peer.
|
Content Updates | With content updates, you can either download
and install them separately on each firewall, or download them on
one peer and sync the update to the other peer. You must install
the update on each peer.
|
Licenses/Subscriptions |
|
Support Subscription |
|
Ethernet Interface IP Addresses | All Ethernet interface configuration settings
sync except for the IP address ( Network Interface Ethernet |
Loopback Interface IP Addresses | All Loopback interface configuration settings
sync except for the IP address ( Network Interface Loopback |
Tunnel Interface IP Addresses | All Tunnel interface configuration settings
sync except for the IP address ( Network Interface Tunnel |
LACP System Priority | Each peer must have a unique LACP System
ID in an active/active deployment ( Network Interface Ethernet Add Aggregate Group System Priority |
VLAN Interface IP Address | All VLAN interface configuration settings
sync except for the IP address ( Network Interface VLAN |
Virtual Routers | Virtual router configuration synchronizes
only if you have enabled VR Sync ( Device High Availability Active/Active Config Packet Forwarding |
IPSec Tunnels | IPSec tunnel configuration synchronization
is dependent on whether you have configured the Virtual Addresses
to use Floating IP addresses ( Device High Availability Active/Active Config Virtual Address |
GlobalProtect Portal Configuration | GlobalProtect portal configuration synchronization
is dependent on whether you have configured the Virtual Addresses
to use Floating IP addresses ( Network GlobalProtect Portals |
GlobalProtect Gateway Configuration | GlobalProtect gateway configuration synchronization
is dependent on whether you have configured the Virtual Addresses
to use Floating IP addresses ( Network GlobalProtect Gateways |
QoS | QoS configuration synchronizes only if you
have enabled QoS Sync (Device High Availability Active/Active Config Packet Forwarding |
LLDP | No LLDP state or individual firewall data
is synchronized in an active/active configuration ( Network Network Profiles LLDP |
BFD | No BFD configuration or BFD session data
is synchronized in an active/active configuration ( Network Network Profiles BFD Profile |
IKE Gateways | IKE gateway configuration synchronization
is dependent on whether you have configured the Virtual Addresses
to use floating IP addresses ( Network IKE Gateways |
Master Key | The master key must be identical on each
firewall in the HA pair, but you must manually enter it on each
firewall ( Device Master
Key and Diagnostics Before changing
the master key, you must disable config sync on both peers ( Device High Availability General Setup Enable Config Sync check box) and
then re-enable it after you change the keys. |
Reports, logs, and Dashboard Settings | Log data, reports, and dashboard data and
settings (column display, widgets) are not synced between peers.
Report configuration settings, however, are synced. |
HA settings |
|
Certificates for Device Management and Syslog
Communication over SSL only | Device Certificate Management Certificates Certificates
used for device management or for syslog communication over SSL
don’t synchronize with an HA peer. |
Certificates in a Certificate Profile | Device Certificate Management Certificate Profile |
SSL/TLS Service Profile for Device Management
only | Device Certificate Management SSL/TLS Service
Profile SSL/TLS Service Profile
for Device Management doesn’t synchronize with an HA peer. |
Recommended For You
Recommended Videos
Recommended videos not found.