Error state due to a dataplane failure or a configuration mismatch such as: only one firewall configured for packet forwarding, VR sync, or QoS sync.

In active/passive mode, all of the causes listed for the tentative state cause the non-functional state:
- Failure of a firewall.
- Failure of a monitored object (a link or path).
- The firewall leaves the suspended or non-functional state.

Information about high availability states:
https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/high-availability/ha-firewall-states