End-of-Life (EoL)
What Settings Don’t Sync in Active/Passive HA?
You must configure the following settings on each firewall
in an HA pair in an active/passive deployment. These settings do
not sync from one peer to another.
Configuration Item | What Doesn’t Sync
in Active/Passive? |
|---|---|
Management Interface Settings | All management configuration settings must
be configured individually on each firewall, including:
|
Multi-vsys Capability | You must activate the Virtual Systems license
on each firewall in the pair to increase the number of virtual systems
beyond the base number provided by default on PA-3000 Series, PA-5000
Series, PA-5200 Series, and PA-7000 Series firewalls. You
must also enable Multi Virtual System Capability on
each firewall (Device Setup Management General Settings |
Panorama Settings | Set the following Panorama settings on each
firewall ( Device Setup Management Panorama Settings
|
SNMP | Device Setup Operations SNMP Setup |
Services | Device Setup Services |
Global Service Routes | Device Setup Services Service
Route Configuration |
Telemetry and Threat Intelligence Settings | Device Setup Telemetry and Threat Intelligence |
Data Protection | Device Setup Content-ID Manage Data Protection |
Jumbo Frames | Device Setup Session Session Settings Enable Jumbo Frame |
Forward Proxy Server Certificate Settings | Device Setup Session Decryption Settings SSL Forward Proxy Settings |
Master Key Secured by HSM | Device Setup HSM Hardware
Security Module Provider Master Key Secured
by HSM |
Log Export Settings | Device Scheduled Log Export |
Software Updates | With software updates, you can either download
and install them separately on each firewall, or download them on
one peer and sync the update to the other peer. You must install
the update on each peer ( Device Software |
GlobalProtect Agent Package | With GlobalProtect client updates, you can
either download and install them separately on each firewall, or
download them to one peer and sync the update to the other peer.
You must activate separately on each peer ( Device GlobalProtect Client |
Content Updates | With content updates, you can either download
and install them separately on each firewall, or download them on
one peer and sync the update to the other peer. You must install
the update on each peer ( Device Dynamic Updates |
Licenses/Subscriptions | Device Licenses |
Support Subscription | Device Support |
Master Key | The master key must be identical on each
firewall in the HA pair, but you must manually enter it on each
firewall ( Device Master
Key and Diagnostics Before changing
the master key, you must disable config sync on both peers ( Device High Availability General Setup Enable Config Sync check box) and
then re-enable it after you change the keys. |
Reports, logs, and Dashboard Settings | Log data, reports, and Dashboard data and
settings (column display, widgets) are not synced between peers.
Report configuration settings, however, are synced. |
HA settings | Device High Availability |
Certificates for Device Management and Syslog
Communication over SSL only | Device Certificate Management Certificates Certificates
used for device management or for syslog communication over SSL
don’t synchronize with an HA peer. |
Certificates in a Certificate Profile | Device Certificate Management Certificate Profile |
SSL/TLS Service Profile for Device Management
only | Device Certificate Management SSL/TLS Service
Profile SSL/TLS Service Profile
for Device Management doesn’t synchronize with an HA peer. |
Recommended For You
Recommended Videos
Recommended videos not found.
