topic Re: PA-5400 Series Port HA1 Down every time there is an upgrade in Next-Generation Firewall Discussions

PA-5400 Series Port HA1 Down every time there is an upgrade

Sitthichai — Tue, 06 Jun 2023 02:52:27 GMT

Hi everyone,

I found a problem every time we upgrade the PA-5420 firmware. After the device reboots, port HA1 is always down. I tried to find the relevant logs. It could not find any reason for this happening.

Has anyone encountered this kind of problem? I want to know what is the root cause of this problem.

We directly connect Active and Passive.

We upgraded from PAN-OS 10.2.3 to 10.2.4 and encountered this problem on both devices.

We work around this by unplugging and re-inserting Port HA1 every time the device reboots.

Thank you.

Re: PA-5400 Series Port HA1 Down every time there is an upgrade

Sitthichai — Tue, 06 Jun 2023 08:44:54 GMT

I see only log about "HA1 MAIN link flapping recovering after monitor-hold-time of 3000ms"

I'm not sure what caused it.

Re: PA-5400 Series Port HA1 Down every time there is an upgrade

KevinC-WVM — Thu, 13 Jul 2023 14:28:22 GMT

Seeing the same on two of my PA-5420 pairs that are in Active/Passive configuration. They are using sfp-rj45 modules with cat 6a connecting the firewalls. Ran into it again today with the 10.2.4-h3 update.

Re: PA-5400 Series Port HA1 Down every time there is an upgrade

Nicholas.Moore — Wed, 30 Aug 2023 01:32:40 GMT

I have pairs of PA-5410 in active/passive and I've had this problem every time I've upgraded - including to the latest preferred v10.2.4-h4. The pairs go into a split-brain with HA1 showing down and it takes several minutes for the issue to resolve itself. I do *not* have this problem on any of the PA-4x0 series in acitve/passive.

Re: PA-5400 Series Port HA1 Down every time there is an upgrade

Sitthichai — Mon, 11 Sep 2023 05:21:58 GMT

Hey everyone I get summary in this case.

TAC informed me about the SFP issue.
I used copper SFP for HA1 and HA1-B.
TAC said it was a problem with the SFP driver itself not being compatible with the 5400 series. The solution was to switch to fiber sfp+ SR for HA1 and HA1-B, and I didn't have the problem again. When we reboot the device.

Hope it can help you.