How to troubleshoot when High-Availability Heartbeat Backup is down

• Palo Alto Networks Firewalls in High-Availability
• PAN-OS 9.1 and 10.1
• Active/Active or Active/Passive High-Availability
• Heartbeat Backup is enabled at "Device > High Availability > General > Election Settings"
• Management interfaces of both the Firewalls can route to each other.

1. When the heartbeat backup link is enabled, split brain is prevented because redundant heartbeats and hello messages are transmitted over the management port.
2. Heartbeat backup uses port 28771 on the management interface.
3. If it has been confirmed that the management interfaces of both the Firewalls can route to each other, we can perform a tcpdump on both the Firewalls simultaneously to check for packets on port 28771 :

tcpdump snaplen 0 filter "port 28771"

4. Once tcpdump has been done on both the Firewalls, the packet captures can be compared to isolate if there is any packet loss.