An administrator pushes a new configuration from Panorama to a pair of firewalls that are configured as an active/passive HA pair.
Which NGFW receives the configuration from Panorama?
An administrator pushes a new configuration from Panorama to a pair of firewalls that are configured as an active/passive HA pair.
Which NGFW receives the configuration from Panorama?
When a configuration is pushed from Panorama to a pair of firewalls configured as an active/passive HA (High Availability) pair, both firewalls receive the configuration independently. The process does not involve synchronization between the two firewalls for Panorama-pushed configurations. Synchronization typically applies to local changes made on the firewalls themselves.
I thisnk answer is D https://live.paloaltonetworks.com/t5/General-Topics/config-push-from-panorama-to-HA-PA/td-p/236297
D https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CleOCAS
D is the correct answer. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CleOCAS
Correct Answer is D Policies and templates from Panorama must be committed to both active and passive HA devices! They are not getting synched!
This has some info for migrating HA into Panorama: https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/manage-firewalls/transition-a-firewall-to-panorama-management/migrate-a-firewall-ha-pair-to-panorama-management Basically, Panorama configuration is not synced regardless of if the config sync box is checked. Only local configuration will be synchronized if the config sync box is checked.
Answer: D
Should be C
no its D. although we always set up HA with sync enabled, its not a requirement for HA. so just HA without the "additional and optional" sync, will not sync.
I set up a lab with an HA pair, both devices received the configuration in their respective template stack and then, performed a commit. Because the values are the same, no synchronization is needed.
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CleOCAS
Sync only happens if you commit locally and enable config sync is ticked under the HA section
In my opinion C
The Correct answer here is C , both firewalls will receive the configuration and will need to sync what the configuration it is, may be an application , objects ,security policy . On panorama you will also see on the devices it will show they are in-sync or out of sync
D is correct
only D
Ths answer is D
Answer: D sk suggests that Panorama policy is pushed to both units and no sync is performed per se. This means that any local policy would need to be synced separately https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CleOCAS
D is correct