We have a client who does not have a HA2 link and we expected the fail over to not be smooth because the sessions are not being synced, but we found that HA state information was also not being synced. According to the documentation, this should happen over HA1, which is functional. What am I missing? Thank you!

During an upgrade from PAN-OS 10.2.3 to PAN-OS 10.2.12-h2 we saw the upgraded firewall go non-functional due to NAT Oversubscription mismatch. I have seen this when upgrading between major versions, but not in such a minor change. Is it expected to have a change like this when upgrading maintenance versions?

Hi I have a Firewall currently setup in a Panorama Device Group. I now want to to manage a new Firewall that has a similar set of rules (not a HA) so I want to put it in the same Device Group, so the rules are synced going forward. My question is what happens to the rules on the 2nd Firewall when I add it to the Device Group and push the policy? Does the Device Group Rules (currently from the 1st Firewall import) get merged with the existing rules? Will duplicates get removed? Or will it overwrite the whole config? Many thanks.