If you’ve been working with networks for a while, you will understand the importance of limiting failures. One of the ways we do this is with HA. Palo Alto firewalls can be deployed in an active/passive or an active/active pair. Active/passive is the simplest option, while active/active requires deeper understanding of the network. To maintain HA, the firewalls have special links, the control link (HA1), the data link (HA2), and possibly a packet-forwarding link (HA3). These may be dedicated or in-band links, depending on the model of the firewall. The firewalls need to detect failures. This includes firewall failure, link failure, and path failure. If you want to use Active/Active, you need to be aware of additional concerns, such as which firewall becomes the flow owner? How can we distribute traffic evenly across the pair? What happens if traffic arrives at the wrong firewall? In this video, I’ll walk you through the process of configuring active/passive high availability. Overview of this video: 0:00 Introduction 0:29 HA Types 2:30 HA Links 5:06 Detecting Failures 7:23 Configuration 14:54 Active/Active Sessions Patreon information: https://networkdirection.net/patreon/ LET'S CONNECT 🌏 null 🌏 https://twitter.com/NetwrkDirection 🌏 https://www.patreon.com/NetworkDirection 🌏 https://www.networkdirection.net/ #NetworkDirection #networking #paloalto Best Practices: https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/high-availability/ha-concepts/ha-links-and-backup-links/ha-ports-on-the-pa-7000-series-firewall https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/high-availability/set-up-activepassive-ha/configure-activepassive-ha