Community Archive (Customer) asked a question.
I have two Palo Alto firewalls in an high-availability cluster. For some reason one day they stopped synchronizing configuration changes. This caused the cluster to not want to commit new changes. And I assume if there had been a real need to fail-over there would have been other service issues.
WUG was able to help me keep an eye on the configuration sync status both to diagnose the sync problem and ensure that my HA would failover with a complete and accurate configuration. I created an SSH active monitor that would log in to the Palo Alto firewall and execute this CLI command.
admin@FIREWALL(active)> show high-availability all | match
"Running Configuration:"
Running Configuration: synchronized
The SSH active monitor is expecting to see the keyword synchronized to be considered "up'.
The only HA related items I found in the MIB were under OID 1.3.6.1.4.1.25461.2.1.2.1
<ul>
<li>panSysHAState (11)</li>
<li>panSysHAPeerState (12)</li>
<li>panSysHAMode (13)</li>
</ul>
Palo Alto doesn't offer an OID for HA config sync status that I could find.
Thank you all for the information. We have a little bit of time this week to work on this need. We appreciate the time involved to give us all the help!
Thanks for sharing. Did you have a look at SNMP? The only reason I ask is in case there were design considerations others may want to be aware of.
Andrei
Thanks for sharing and the feedback.
Andrei