Skip to content
ConfigProof

All controls

PAN-SEC-060MediumPAN-OS

Configured HA group has no path monitoring

At a glance

Base severity

Medium

Area

High Availability

Platform

PAN-OS

Evidence level

Fact1.00

Benchmark reference

Reads the export, not the device

ConfigProof reads a configuration export. This control is evaluated against the objects in that file, and it reports what the file says. It does not connect to the device and sees no traffic, so a finding here describes the configuration, not what the firewall is doing right now.

Why it matters

Link monitoring sees a port go down. Path monitoring is what sees the network beyond the port stop answering. Without it the pair holds an upstream failure on the active member, because from the firewall's own ports everything still looks connected, and the standby waits for a signal that never comes.

How to fix it

Web interface

The steps below are written for the web interface. A finding raised on your own export carries the same steps with your object names filled in.

  1. Enable path monitoring on the HA group and give it one path group or more, with the destinations whose loss should move traffic.
  2. Add a path group with destinations that prove upstream reachability, such as the next hop and a target beyond it.
  3. Set the failure condition to match how many destinations must fail before failover.

Command line

PAN-OS CLI

set deviceconfig high-availability group monitoring path-monitoring enabled yesset deviceconfig high-availability group monitoring path-monitoring path-group virtual-router <virtual-router> enabled yes

An example. Values in angle brackets are yours to supply; a finding on your own export fills in the names it read. Nothing here commits. Review the candidate configuration, then commit it yourself.

Read it back

show deviceconfig high-availability group monitoring
Values to fill in1
<virtual-router>
The virtual router
Before you type it1
  • Monitoring is what triggers a failover. Set the thresholds before you enable it.

How to confirm the fix

  • Confirm the group reports path monitoring enabled with one path group or more.
  • Confirm each monitored destination answers from the firewall before relying on it.

Limits

  • This reads the configured monitoring, not whether any monitored path is currently up.
  • A configuration export contains one peer, so the other member's monitoring cannot be compared.

Compliance references

No benchmark recommendation is mapped to this control in this version.

More in High Availability

See it on your own firewall

One complete analysis of one firewall costs nothing. A card is required and nothing is charged.

Start a free analysis