! PermitANY — Palo Alto HA (Active/Passive or Active/Active)
! High Availability configuration for Palo Alto PAN-OS firewalls: HA1 control link, HA2 data link, passive link state, preemption, and session synchronization.
! Generated: 2026-09-20
! These are EXAMPLE values. Replace with your actual config before deploying.
!
# Palo Alto HA Configuration — PA-FW-01
#
set deviceconfig high-availability enabled yes
set deviceconfig high-availability group group-id 1
set deviceconfig high-availability group mode active-passive
{{#if (eq priority "primary")}}
set deviceconfig high-availability group election-option priority primary
{{/if}}
{{#if (eq priority "secondary")}}
set deviceconfig high-availability group election-option priority secondary
{{/if}}
{{#if (eq preemption "yes")}}
set deviceconfig high-availability group election-option preemptive yes
{{/if}}
#
# HA1 Control Link
set deviceconfig high-availability interface ha1 port management
set deviceconfig high-availability interface ha1 ip-address 10.0.0.1
set deviceconfig high-availability interface ha1 netmask 255.255.255.252
set deviceconfig high-availability interface ha1 gateway 10.0.0.2
{{#if (eq ha1_encryption "yes")}}
set deviceconfig high-availability interface ha1 encrypt-enable yes
{{/if}}
set deviceconfig high-availability group peer-ip 10.0.0.2
#

# HA2 Data Link (Session Sync)
set deviceconfig high-availability interface ha2 port ethernet1/7
set deviceconfig high-availability interface ha2 ip-address 10.0.1.1
set deviceconfig high-availability interface ha2 netmask 255.255.255.252
{{#if (eq ha2_keepalive "yes")}}
set deviceconfig high-availability interface ha2 enable-session-synchronization yes

{{/if}}
#
set deviceconfig high-availability group election-option timers passive-hold-timer-period 500
{{#if (eq session_sync "yes")}}
set deviceconfig high-availability group state-synchronization enabled yes
{{/if}}
#
commit