Palo Alto HA Architecture

HA Architecture – Links

HA1 (control link), HA1 backup, Heartbeat backup

  • Config synchronization
  • Management plane runtime state synchronization
    • FIB, user-group mappings, DHCP leases, DNS cache, etc.
  • HA state communication

HA2 (data link) & HA2 backup

  • Session synchronization
    • A/P – We do not sync ICMP sessions.
    • A/A – We do not sync Multicast sessions.
  • Data plane runtime state synchronization.
    • ARP table, Neighbor table, user-IP mappings, etc.
  • You cannot ping the HA2 interface


  • Packet forwarding link (Active/Active only)
  • Supports link aggregation.

HA Architecture – Active/Passive States

  • Initial – Booting up.
  • Active – Processes all traffic.
  • Passive – Backs up active device.
  • Non-functional – Device in recovery from the path, link, or task failure.
  • Suspend – Administrative deactivation or excessive flapping