3.3 Ensure 'Passive Link State' and 'Preemptive' are configured appropriately - Passive Link State

Information

Set the Passive Link State to auto, and uncheck the Preemptive option to disable it.
Rationale:
Simultaneously enabling the 'Preemptive' option and setting the 'Passive Link State' option to 'Shutdown' could cause a 'preemptive loop' if Link and Path Monitoring are both configured. This will negatively impact the availability of the firewall and network services, should a monitored failure occur.

Solution

To set Active/Passive Settings correctly:
Navigate to Device > High Availability > Active/Passive Settings.
Set Passive Link State to auto.
To set Election Settings correctly:
Navigate to Device > High Availability > Election Settings.
Set Preemptive to be disabled.
or
To remediate these settings, execute the following CLI command:
username@hostname#set deviceconfig high-availability group mode active-passive passive-link-state
Default Value:
Not Configured

See Also

https://workbench.cisecurity.org/files/1780

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-13(5)

Plugin: Palo_Alto

Control ID: 58b85699546d6886fba3c69ea8538471d7225cd0eba6fb867d682ad7f0935c90