PCNSE Question #113: Real Exam Question with Answer & Explanation

Question

What are two prerequisites for configuring a pair of Palo Alto Networks firewalls in an active/passive High Availability (HA) pair? (Choose two.)

Options

• AThe management interfaces must be on the same network.
• BThe firewalls must have the same set of licenses.
• CThe peer HA1 IP address must be the same on both firewalls.
• DHA1 should be connected to HA1, either directly or with an intermediate Layer 2 device.

Explanation

Two prerequisites for a Palo Alto Networks active/passive HA pair are: (B) both firewalls must have the same set of licenses-mismatched licenses prevent proper HA synchronization and consistent enforcement; and (D) the HA1 (control link) interface on each peer must connect directly to the HA1 interface of the other peer, or through an intermediate Layer 2 switch, because HA1 carries heartbeat and configuration synchronization traffic. Option A is incorrect-management interfaces need not share a subnet. Option C is wrong because each firewall has its own unique HA1 IP address; they are configured with the peer's HA1 IP, so the addresses must differ.

No community discussion yet for this question.