Reference: HA Synchronization
If you have enabled configuration synchronization on both peers in an HA pair, most of the configuration settings you configure on one peer will automatically sync to the other peer upon commit. To avoid configuration conflicts, always make configuration changes on the active (active/passive) or active-primary (active/active) peer and wait for the changes to sync to the peer before making any additional configuration changes.
Only committed configurations synchronize between HA peers. Any configuration in the commit queue at the time of an HA sync will not be synchronized.
The following topics identify which configuration settings you must configure on each firewall independently (these settings are not synchronized from the HA peer).
What Settings Don’t Sync in Active/Passive HA?
You must configure the following settings on each firewall in an HA pair in an active/passive deployment. These settings do not sync from one peer to another.
Configuration Item What Doesn’t Sync in Active/Passive?
Management Interface Settings All management configuration settings must be configured individually on each firewall, including: Device > Setup > Management > General Settings —Hostname, Domain, Login Banner, SSL/TLS Service Profile, Time Zone, Locale, Date, Time, Latitude, Longitude. The configuration for the associated SSL/TLS Service profile ( Device > Certificate Management > SSL/TLS Service Profile and the associated certificates ( Device > Certificate Management > Certificates) is synchronized. It is just the setting of which SSL/TLS Service Profile to use on the Management interface that does not sync. Device > Setup > Management > Management Interface Settings —IP Type, IP Address, Netmask, Default Gateway, IPv6 Address/Prefix Length, Default IPv6 Gateway, Speed, MTU, and Services (HTTP, HTTP OCSP, HTTPS, Telnet, SSH, Ping, SNMP, User-ID, User-ID Syslog Listener-SSL, User-ID Syslog Listener-UDP)
Multi-vsys Capability You must activate the Virtual Systems license on each firewall in the pair to increase the number of virtual systems beyond the base number provided by default on PA-3000 Series, PA-4000 Series, PA-5000 Series, and PA-7000 Series firewalls. You must also enable Multi Virtual System Capability on each firewall ( Device > Setup > Management > General Settings).
Administrator Authentication Settings You must define the authentication profile and certificate profile for administrative access to the firewall locally on each firewall ( Device > Setup > Management > Authentication).
Panorama Settings Set the following Panorama settings on each firewall ( Device > Setup > Management > Panorama Settings). Panorama Servers Disable Panorama Policy and Objects and Disable Device and Network Template
SNMP Device > Setup > Operations > SNMP Setup
Statistics Collection Device > Setup > Operations > Statistics Service Setup
Services Device > Setup > Services
Global Service Routes Device > Setup > Services > Service Route Configuration
Data Protection Device > Setup > Content-ID > Manage Data Protection
Jumbo Frames Device > Setup > Session > Session Settings > Enable Jumbo Frame
Forward Proxy Server Certificate Settings Device > Setup > Session > Decryption Settings > SSL Forward Proxy Settings
Master Key Secured by HSM Device > Setup > HSM > Hardware Security Module Provider > Master Key Secured by HSM
Log Export Settings Device > Scheduled Log Export
Software Updates With software updates, you can either download and install them separately on each firewall, or download them on one peer and sync the update to the other peer. You must install the update on each peer. Device > Software
GlobalProtect Agent Package With GlobalProtect client updates, you can either download and install them separately on each firewall, or download them to one peer and sync the update to the other peer. You must activate separately on each peer. Device > GlobalProtect Client
Content Updates With content updates, you can either download and install them separately on each firewall, or download them on one peer and sync the update to the other peer. You must install the update on each peer. Device > Dynamic Updates
Licenses/Subscriptions Device > Licenses
Support Subscription Device > Support
Master Key The master key must be identical on each firewall in the HA pair, but you must manually enter it on each firewall ( Device > Master Key and Diagnostics). Before changing the master key, you must disable config sync on both peers ( Device > High Availability > General > Setup and clear the Enable Config Sync check box) and then re-enable it after you change the keys.
Reports, logs, and Dashboard Settings Log data, reports, and Dashboard data and settings (column display, widgets) are not synced between peers. Report configuration settings, however, are synced.
HA settings Device > High Availability
What Settings Don’t Sync in Active/Active HA?
You must configure the following settings on each firewall in an HA pair in an active/active deployment. These settings do not sync from one peer to another.
Configuration Item What Doesn’t Sync in Active/Active?
Management Interface Settings You must configure all management settings individually on each firewall, including: Device > Setup > Management > General Settings —Hostname, Domain, Login Banner, SSL/TLS Service Profile, Time Zone, Locale, Date, Time, Latitude, Longitude. The configuration for the associated SSL/TLS Service profile ( Device > Certificate Management > SSL/TLS Service Profile and the associated certificates ( Device > Certificate Management > Certificates) is synchronized. It is just the setting of which SSL/TLS Service Profile to use on the Management interface that does not sync. Device > Setup > Management > Management Interface Settings —IP Address, Netmask, Default Gateway, IPv6 Address/Prefix Length, Default IPv6 Gateway, Speed, MTU, and Services (HTTP, HTTP OCSP, HTTPS, Telnet, SSH, Ping, SNMP, User-ID, User-ID Syslog Listener-SSL, User-ID Syslog Listener-UDP)
Multi-vsys Capability You must activate the Virtual Systems license on each firewall in the pair to increase the number of virtual systems beyond the base number provided by default on PA-3000 Series, PA-4000 Series, PA-5000 Series, and PA-7000 Series firewalls. You must also enable Multi Virtual System Capability on each firewall ( Device > Setup > Management > General Settings).
Administrator Authentication Settings You must define the authentication profile and certificate profile for administrative access to the firewall locally on each firewall ( Device > Setup > Management > Authentication).
Panorama Settings Set the following Panorama settings on each firewall ( Device > Setup > Management > Panorama Settings). Panorama Servers Disable Panorama Policy and Objects and Disable Device and Network Template
SNMP Device > Setup > Operations > SNMP Setup
Statistics Collection Device > Setup > Operations > Statistics Service Setup
Services Device > Setup > Services
Global Service Routes Device > Setup > Services > Service Route Configuration
Data Protection Device > Setup > Content-ID > Manage Data Protection
Jumbo Frames Device > Setup > Session > Session Settings > Enable Jumbo Frame
Forward Proxy Server Certificate Settings Device > Setup > Session > Decryption Settings > SSL Forward Proxy Settings
HSM Configuration Device > Setup > HSM
Log Export Settings Device > Scheduled Log Export
Software Updates With software updates, you can either download and install them separately on each firewall, or download them on one peer and sync the update to the other peer. You must install the update on each peer. Device > Software
GlobalProtect Agent Package With GlobalProtect client updates, you can either download and install them separately on each firewall, or download them to one peer and sync the update to the other peer. You must activate separately on each peer. Device > GlobalProtect Client
Content Updates With content updates, you can either download and install them separately on each firewall, or download them on one peer and sync the update to the other peer. You must install the update on each peer. Device > Dynamic Updates
Licenses/Subscriptions Device > Licenses
Support Subscription Device > Support
Ethernet Interface IP Addresses All Ethernet interface configuration settings sync except for the IP address ( Network > Interface > Ethernet).
Loopback Interface IP Addresses All Loopback interface configuration settings sync except for the IP address ( Network > Interface > Loopback).
Tunnel Interface IP Addresses All Tunnel interface configuration settings sync except for the IP address ( Network > Interface > Tunnel).
LACP System Priority Each peer must have a unique LACP System ID in an active/active deployment ( Network > Interface > Ethernet > Add Aggregate Group > System Priority).
VLAN Interface IP Address All VLAN interface configuration settings sync except for the IP address ( Network > Interface > VLAN).
Virtual Routers Virtual router configuration synchronizes only if you have enabled VR Sync ( Device > High Availability > Active/Active Config > Packet Forwarding). Whether or not to do this depends on your network design, including whether you have asymmetric routing.
IPSec Tunnels IPSec tunnel configuration synchronization is dependent on whether you have configured the Virtual Addresses to use Floating IP addresses ( Device > High Availability > Active/Active Config > Virtual Address). If you have configured a floating IP address, these settings sync automatically. Otherwise, you must configure these settings independently on each peer.
GlobalProtect Portal Configuration GlobalProtect portal configuration synchronization is dependent on whether you have configured the Virtual Addresses to use Floating IP addresses ( Network > GlobalProtect > Portals). If you have configured a floating IP address, the GlobalProtect portal configuration settings sync automatically. Otherwise, you must configure the portal settings independently on each peer.
GlobalProtect Gateway Configuration GlobalProtect gateway configuration synchronization is dependent on whether you have configured the Virtual Addresses to use Floating IP addresses ( Network > GlobalProtect > Gateways). If you have configured a floating IP address, the GlobalProtect gateway configuration settings sync automatically. Otherwise, you must configure the gateway settings independently on each peer.
QoS QoS configuration synchronizes only if you have enabled QoS Sync ( Device > High Availability > Active/Active Config > Packet Forwarding). You might choose not to sync QoS setting if, for example, you have different bandwidth on each link or different latency through your service providers.
LLDP No LLDP state or individual firewall data is synchronized in an active/active configuration ( Network > Network Profiles > LLDP).
BFD No BFD configuration or BFD session data is synchronized in an active/active configuration ( Network > Network Profiles > BFD Profile).
IKE Gateways IKE gateway configuration synchronization is dependent on whether you have configured the Virtual Addresses to use floating IP addresses ( Network > IKE Gateways). If you have configured a floating IP address, the IKE gateway configuration settings sync automatically. Otherwise, you must configure the IKE gateway settings independently on each peer.
Master Key The master key must be identical on each firewall in the HA pair, but you must manually enter it on each firewall ( Device > Master Key and Diagnostics). Before changing the master key, you must disable config sync on both peers ( Device > High Availability > General > Setup and clear the Enable Config Sync check box) and then re-enable it after you change the keys.
Reports, logs, and Dashboard Settings Log data, reports, and dashboard data and settings (column display, widgets) are not synced between peers. Report configuration settings, however, are synced.
HA settings Device > High Availability (The exception is Device > High Availability > Active/Active Configuration > Virtual Addresses, which do sync.)
Synchronization of System Runtime Information
The following table summarizes what system runtime information is synchronized between HA peers.
Runtime Information Config Synced? HA Link Details
A/P A/A
Management Plane
User to Group Mappings Yes Yes HA1
DHCP Lease (as server) Yes Yes HA1
DNS Cache No No N/A
FQDN Refresh No No N/A
IKE Keys (phase 2) Yes Yes HA1
BrightCloud URL Database No No N/A
BrightCloud URL Cache No No N/A This feature is disabled by default and must be enabled separately on each HA peer.
BrightCloud Bloom Filter No No N/A This feature is disabled by default and must be enabled separately on each HA peer.
PAN-DB URL Cache Yes No HA1 This is synchronized upon database backup to disk (every eight hours, when URL database version updates), or when the firewall reboots.
Content (manual sync) Yes Yes HA1
PPPoE, PPPoE Lease Yes Yes HA1
DHCP Client Settings and Lease Yes Yes HA1
SSL VPN Logged in User List Yes Yes HA1
Forward Information Base (FIB) Yes Yes HA1
Dataplane
Session Table Yes Yes HA2 Active/passive peers do not sync ICMP or host session information. Active/active peers do not sync host session, multicast session, or BFD session information.
ARP Table Yes No HA2 Upon upgrade to PAN-OS 7.1, the ARP table capacity automatically increases. To avoid a mismatch, upgrade both peers within a short period of time. As a best practice, clear the ARP cache ( clear arp ) on both peers prior to upgrading to PAN-OS 7.1.
Neighbor Discovery (ND) Table Yes No HA2
MAC Table Yes No HA2
IPSec Sequence Number (anti-replay) Yes Yes HA2
DoS Protection Yes Yes HA2
User to IP Address Mappings Yes Yes HA2
Virtual MAC Yes Yes HA2

Related Documentation