Managing Priority and Failover in Panorama HA
Each Panorama peer in the HA pair is assigned a
priority value. The priority value
of the primary or secondary peer determines which will be eligible for being the main
point of administration and log management. The peer set as primary assumes the active
state, and the secondary becomes passive.
Typically, the active peer is responsible for handling all configuration
changes and pushing them to the managed firewalls. While it is possible for the passive
peer to push configuration changes, this is not recommended as it may lead to issues
within the HA setup.
The passive peer is synchronized and ready to transition to the
active state if a path, link, system, or network failure occur on
the active Panorama.
When a failover occurs, only the state (active or passive) of
the Panorama peer changes; the priority (primary and secondary)
does not. For example, when the primary peer fails, its status changes
from active-primary to passive-primary.
A peer in the active-secondary state can perform all functions
with two exceptions:
It cannot manage firewall or Log Collector deployment
functions such as license updates or software upgrades.
It cannot log to an NFS until you manually change its priority
to primary. Only the Panorama virtual appliance in Legacy mode supports
NFS.
The following table lists the capabilities of Panorama based
on its state and priority settings:
Panorama HA Capabilities
In a Panorama HA pair, when back-to-back commits are performed, the second commit
is queued and waits for the first commit to complete on the active device.
For more information, see
Panorama HA Prerequisites or
Set Up HA on Panorama.
