PaloAlto Networks PA-5400 Series Hardware Reference Manual page 15

PA-5400 Series Firewall Overview
Item Component
4 QSFP28 ports 41 through
44
5 HSCI port
6
HA1-A and HA1-B ports
7
MGT port
PA-5400 Series Next-Gen Firewall Hardware Reference
Description
Four (QSFP+/QSFP28) 40Gbps/100Gbps Ethernet ports.
One 40Gbps port that can be used to connect two
PA-5400 Series firewalls in a high availability (HA)
configuration as follows:
• In an active/passive configuration, this port is for HA2
(data link).
• In an active/active configuration, you can configure
this port for HA2 and HA3. HA3 is used for packet
forwarding for asymmetrically routed sessions that
require Layer 7 inspection for App-ID and Content-ID.
The HSCI ports must be connected directly
between the two firewalls in the HA
configuration (without a switch or router
between them). When directly connecting
the HSCI ports between two PA-5400 Series
firewalls that are physically located near each
other, Palo Alto Networks recommends that
you use an active or passive QSFP+ cable.
For installations where the two firewalls are
not near each other and you cannot use an
active or passive QSFP+ cable, use a standard
SFP+ transceiver and the appropriate cable
length.
Two SFP+ 1Gbps/10Gbps ports for high availability (HA)
control.
If the firewall dataplane restarts due to a
failure or manual restart, the HA1-B link will
also restart. If this occurs and the HA1-A
link is not connected and configured, then a
split brain condition occurs. Therefore, we
recommend that you connect and configure
the HA1-A ports and the HA1-B ports to
provide redundancy and to avoid split brain
issues.
Use this SFP+ 1Gbps/10Gbps port to access the
management web interface and perform administrative
tasks. The firewall also uses this port for management
15
2022 Palo Alto Networks, Inc.
©