©
Palo
Alto
Networks,
Inc.
Panorama
6.1
Administrator’s
Guide
•
179
Panorama
High
Availability
Failover
Triggers
Failover
Triggers
When
a
failure
occurs
on
the
active
device
and
the
passive
device
takes
over
the
task
of
managing
the
firewalls,
the
event
is
called
a
failover.
A
failover
is
triggered
when
a
monitored
metric
on
the
active
device
fails.
This
failure
transitions
the
state
on
the
primary
Panorama
from
active
‐
primary
to
passive
‐
primary,
and
the
secondary
Panorama
becomes
active
‐
secondary
.
The
conditions
that
trigger
a
failover
are:
The
Panorama
peers
cannot
communicate
with
each
other
and
the
active
peer
does
not
respond
to
health
and
status
polls;
the
metric
used
is
.
When
the
Panorama
peers
cannot
communicate
with
each
other,
the
active
peer
monitors
whether
the
devices
are
still
connected
to
it
before
a
failover
is
triggered.
This
check
helps
in
avoiding
a
failover
and
causing
a
split
‐
brain
scenario,
where
both
Panorama
peers
are
in
an
active
state.
One
or
more
of
the
destinations
(IP
addresses)
specified
on
the
active
peer
cannot
be
reached;
the
metric
used
is
.
In
addition
to
the
failover
triggers
listed
above,
a
failover
also
occurs
when
the
administrator
places
the
device
is
a
suspended
state
or
if
preemption
occurs.
Preemption
is
a
preference
for
the
primary
Panorama
to
resume
the
active
role
after
recovering
from
a
failure
(or
user
‐
initiated
suspension).
By
default,
preemption
is
enabled
and
when
the
primary
Panorama
recovers
from
a
failure
and
becomes
available,
the
secondary
Panorama
relinquishes
control
and
returns
to
the
passive
state.
When
preemption
occurs,
the
event
is
logged
in
the
system
log.
If
you
are
logging
to
an
NFS
datastore,
do
not
disable
preemption
because
it
allows
the
primary
peer
(that
is
mounted
to
the
NFS)
to
resume
the
active
role
and
write
to
the
NFS
datastore.
For
all
other
deployments,
preemption
is
only
required
if
you
want
to
make
sure
that
a
specific
device
is
the
preferred
active
device.
HA
Heartbeat
Polling
and
Hello
Messages
The
HA
peers
use
hello
messages
and
heartbeats
to
verify
that
the
peer
is
responsive
and
operational.
Hello
messages
are
sent
from
one
peer
to
the
other
at
the
configured
Hello
Interval
to
verify
the
state
of
the
other.
The
heartbeat
is
an
ICMP
ping
to
the
HA
peer,
and
the
peer
responds
to
the
ping
to
establish
that
the
devices
are
connected
and
responsive.
By
default,
the
interval
for
the
heartbeat
is
1000
milliseconds
and
8000ms
for
hello
messages.
HA
Path
Monitoring
Path
monitoring
checks
for
network
connectivity
and
link
state
for
a
specified
IP
address.
The
active
peer
uses
ICMP
pings
to
verify
that
one
or
more
destination
IP
addresses
can
be
reached.
You
can,
for
example,
monitor
the
availability
of
an
interconnected
networking
devices
like
a
router
or
a
switch,
connectivity
to
a
server,
or
some
other
vital
device
that
is
in
the
flow
of
traffic.
Make
sure
that
the
node/device
configured
for
monitoring
is
not
likely
to
be
unresponsive,
especially
when
it
comes
under
load,
as
this
could
cause
a
path
monitoring
failure
and
trigger
a
failover.
