An engineer is monitoring an active/active high availability (HA) firewall pair. Which HA firewall state describes the firewall that is currently…

In an Active/Active HA pair, both peers forward traffic, but each takes one of two explicit states—Active-primary or Active-secondary. The state “Active-primary” is defined by Palo Alto Networks as “the firewall that is actively processing traffic and acts as the session owner” in an Active/Active deployment. The generic state “Active” is used only for Active/Passive HA and is not reported by devices running in Active/Active mode. Therefore, the precise state that identifies a traffic-processing firewall in the stated scenario is Active-primary.

A. Initial – Device is booting or negotiating HA; no traffic is processed.

B. Passive – Exists only in Active/Passive HA; firewall does not forward traffic.

C. Active – Valid only for Active/Passive; not a state shown on an Active/Active pair.

1. Palo Alto Networks

PAN-OS 11.0 Administrator’s Guide

“HA Firewall States

” Table-1: Active-primary—“Device actively processes traffic (session owner) in Active/Active HA.” (Doc ID: PAN-OS-AG-11.0

p. 920).

2. Palo Alto Networks TechDocs

“Set Up Active/Active HA

” section “Active-primary and Active-secondary states

” ¶2 (2023).