An administrator is seeing one of the firewalls in a HA active/passive pair moved to "suspended" state due to Non-functional loop. Which three actions will help the administrator resolve this issue?…

Question

Options

• AUse the CLI command show high-availability flap-statistics
• BCheck the HA Link Monitoring interface cables.
• CCheck the High Availability > Link and Path Monitoring settings.
• DCheck High Availability > Active/Passive Settings > Passive Link State
• ECheck the High Availability > HA Communications > Packet Forwarding settings.

• A
  5% (1)
• B
  79% (15)
• E
  16% (3)

Explanation

When a passive firewall enters "suspended" state due to a Non-functional loop, the issue is rooted in how the passive device handles physical links and monitoring - making B, C, and D the correct resolution paths. Option B addresses the physical layer: a disconnected or faulty cable on an HA link-monitored interface can trigger the loop condition, so verifying the physical connections is essential. Option C targets the HA Link and Path Monitoring configuration, where incorrectly defined monitored interfaces or paths can cause the firewall to incorrectly evaluate network state and suspend itself. Option D is the most directly relevant - the Passive Link State setting controls whether the passive firewall's data-plane interfaces stay up ("Auto") or go down ("Shutdown") while passive; leaving it on "Auto" can create actual Layer 2 loops in the network, which is precisely what triggers this "Non-functional loop" suspension.

Why the distractors are wrong: Option A (show high-availability flap-statistics) is a diagnostic/monitoring command that shows how often HA has switched states - useful for analysis, but it doesn't resolve the loop condition. Option E (Packet Forwarding under HA Communications) governs how session traffic is synchronized between peers and has no bearing on loop detection or passive link behavior.

Memory tip: Think "Cables, Config, and passive link State" - the loop is a physical/logical network issue, so you fix it at the physical layer (B), the monitoring policy (C), and the passive interface behavior (D). If the passive firewall's ports are up and active simultaneously with the active firewall's, a switch will see duplicate paths - a classic loop.

No community discussion yet for this question.