HA Sync Job Fails on Passive Firewall when NetFlow Profile applied on Active Firewall

HA Sync Job Fails on Passive Firewall when NetFlow Profile applied on Active Firewall

Created On 04/29/19 11:28 AM - Last Modified 12/04/19 22:42 PM


The Netflow profile is applied on the active firewall and committed successfully. When the config is synced to the passive firewall, the HA Sync job fails with the below error:
Error: NetFlow profile NetFlow-Profile used on interface ethernet1/3 without a valid service-route
(Module: device)
Commit failed

Screenshot showing the error:
Screenshot showing the error


PA-5200 Series firewalls
PA-7000 Series firewalls


This could happen when only on PA-7000 and PA-5200 platforms when the custom service route is not configured (to use data interface) for Netflow service. A Custom Service Route specifying a data port must be configured for NetFlow. The service route can be global or per-vsys. Service router configuration does not get synced over HA.


STEP 1: Navigate to Device > Setup > Services of the passive firewall
STEP 2: Click Service Route Configuration
STEP 3: Under Services, click Netflow and select the required interface (has to be data interface)
STEP 4: Commit the changes on the passive firewall
STEP 5: Do a manual configuration synchronization by navigating to the Dashboard in the High Availability widget, click Sync to peer

Additional Information

For additional information, please view the following references:

  • Print
  • Copy Link


Choose Language