High availability: active/passive vs active/active, HA1/HA2/HA3 and backup links, priority and preemption, link and path monitoring, floating IPs

High availability (HA) pairs two identical firewalls so that if one fails, the other carries on with minimal disruption. Both peers must be the same model, run the same PAN-OS and content versions, and have matching licenses, and each is given a group ID and the peer's HA1 address. HA is configured under Device > High Availability. Because a firewall is often the only path to the Internet or between network segments, HA is how you remove it as a single point of failure.