186
•
Panorama
6.1
Administrator’s
Guide
©
Palo
Alto
Networks,
Inc.
Manage
a
Panorama
HA
Pair
Panorama
High
Availability
Test
Panorama
HA
Failover
To
test
that
your
HA
configuration
works
properly,
trigger
a
manual
failover
and
verify
that
the
peer
transitions
states
successfully.
Switch
Priority
after
Panorama
Failover
to
Resume
NFS
Logging
When
a
Panorama
HA
pair
is
configured
to
use
a
Network
File
Share
(NFS)
based
logging
mechanism,
only
the
primary
Panorama
peer
is
mounted
to
the
NFS
‐
based
log
partition
and
can
write
to
the
NFS.
When
a
failover
occurs,
and
the
passive
Panorama
becomes
active,
its
state
is
active
‐
secondary.
Although
a
secondary
Panorama
peer
can
actively
manage
the
devices,
it
cannot
receive
logs
or
write
to
the
NFS
because
it
does
not
own
the
NFS
partition.
When
the
managed
device
cannot
forward
logs
to
the
primary
Panorama
peer,
the
logs
are
written
to
the
local
disk
on
each
device.
The
devices
maintain
a
pointer
for
the
last
set
of
log
entries
that
were
forwarded
to
Panorama
so
that
when
the
passive
‐
primary
Panorama
becomes
available
again,
they
can
resume
forwarding
logs
to
it.
Use
the
instructions
in
this
section
to
manually
switch
priority
on
the
active
‐
secondary
Panorama
peer
so
that
it
can
begin
logging
to
the
NFS
partition.
The
typical
scenarios
in
which
you
might
need
to
trigger
this
change
are
as
follows:
Preemption
is
disabled.
By
default,
preemption
is
enabled
on
Panorama
and
the
primary
peer
resumes
as
active
when
it
becomes
available
again.
When
preemption
is
disabled,
you
need
to
switch
the
priority
on
the
secondary
peer
to
primary
so
that
it
can
mount
the
NFS
partition,
receive
logs
from
the
managed
devices,
and
write
to
the
NFS partition.
The
active
Panorama
fails
and
cannot
recover
from
the
failure
in
the
short
term.
If
you
do
not
switch
the
priority,
when
the
maximum
log
storage
capacity
on
the
firewall
is
reached,
the
oldest
logs
will
be
overwritten
to
enable
it
to
continue
logging
to
its
local
disk.
This
situation
can
lead
to
loss
of
logs.
Test
Panorama
HA
Failover
Step
1
Log
in
to
the
active
Panorama
peer.
You
can
verify
the
state
of
the
Panorama
server
in
the
bottom
right
corner
of
the
web
interface.
Step
2
Suspend
the
active
Panorama
peer.
Select
Panorama > High Availability
,
and
then
click
the
Suspend
local Panorama
link
in
the
Operational
Commands
section.
Step
3
Verify
that
the
passive
Panorama
peer
has
taken
over
as
active.
On
the
Panorama
Dashboard
,
High Availability
widget,
verify
that
the
state
of
the
Local
passive
server
is
active
and
the
state
of
the
Peer
is
suspended
.
Step
4
Restore
the
suspended
peer
to
a
functional
state.
Wait
for
a
couple
minutes,
and
then
verify
that
preemption
has
occurred,
if
preemptive
is
enabled.
On
the
Panorama
you
previously
suspended:
1.
In
the
Operational
Commands
section
of
the
Device > High
Availability
tab,
click
the
Make local Panorama functional
link.
2.
In
the
High Availability
widget
on
the
Dashboard
,
confirm
that
this
(Local)
Panorama
has
taken
over
as
the
active
peer
and
that
the
other
peer
is
now
in
a
passive
state.
Support
for
a
Network
File
Share
(NFS)
based
logging
mechanism
is
only
available
on
the
Panorama
virtual
appliance.
