Redundancy & Resiliency

Palo Alto Networks next-generation firewalls support a series of redundancy and resiliency features that ensure the firewall will continue to enable the business through secure application enablement

Stateful Active/Active or Active/Passive high availability.

Active/passive and active/active high availability are supported, complete with session and configuration synchronization. Active/passive high availability supports traditional network designs in which all network traffic passes through a single firewall. Active/active high availability enables application control and threat prevention in asymmetric environments.

• Active/passive: The active device continuously synchronizes its configuration and session information with the identically configured passive device. A heartbeat connection between the two identically configured devices ensures seamless failover in the event that the active device goes down.
• Active/active: Firewalls in an active/active configuration continuously synchronize their configuration and session information. If either device fails, a heartbeat connection signals the other device to take over all operations ensuring session continuity in the event of a device or network failure. To better support asymmetrically routed environments, two devices can be deployed in an HA configuration with either virtual wire interfaces or layer 3 interfaces. App-ID and Content-ID are fully supported in asymmetric environments. A/A also incorporates flexible layer 3 deployment options supporting load-sharing and interface IP failover.

Built-in resiliency and component redundancy.

To ensure that management is accessible under periods of heavy traffic, the data plane and the control plane are physically separated, each with dedicated processing and memory. The data plane houses dedicated processing and memory for networking, security and content inspection while dedicated management processing and memory reside on the control plane. The physical separation of data and control plane ensures that management access is always available, irrespective of the traffic load.

The PA-5000 Series supports several levels of hardware component redundancy: the dual power supplies and the dual, solid-state hard disk drives are hot swappable. The single fan tray is also hot swappable. The PA-4000 Series also supports dual power supplies that are hot-swappable.