Palo Alto - How to Suspend the active firewall (recommended)

 On a Palo Alto Networks HA pair, you typically trigger a failover by suspending the active firewall or making the passive firewall active. The safest method is to suspend the active firewall.

Method 1: Suspend the active firewall (recommended)

On the currently active firewall:

1. Verify the current HA state:

   > show high-availability state
   

2. Suspend the active firewall:

   > request high-availability state suspend
   

3. Verify the other firewall has become active:

   > show high-availability state
   

The suspended firewall will remain in the suspended state until you manually make it functional again.

To return the suspended firewall to service

On the suspended firewall:

> request high-availability state functional

Depending on your HA settings (such as Preemptive mode), it may or may not automatically resume the active role.

Method 2: Make the passive firewall active

If you are logged into the passive firewall, you can request it become active:

> request high-availability state functional

If it's already functional but passive, whether it becomes active depends on the HA configuration (preemption, priorities, and current health). Suspending the active firewall is generally the more predictable approach for a controlled failover.

Verify the failover

Use these commands on either firewall:

> show high-availability state

or the more detailed:

> show high-availability all

Before performing a failover

Confirm:

• Configuration is synchronized:

  > show high-availability state
  

  Look for Running Configuration: synchronized.

• Both peers are healthy.
• No critical sessions or maintenance windows would be impacted (unless the failover is planned).

A planned failover is typically seamless for most traffic if session synchronization is enabled, though a brief interruption can still occur for some applications.