topic Re: Aggregate interace behaviour in Next-Generation Firewall Discussions

Aggregate interace behaviour

vishalrsshah — Tue, 02 Jan 2024 14:50:28 GMT

Hi All,

Facing an issue where doing an failover with aggregate interface not working.

Example if I unshut any one link from aggregation link of passive firewall and shut both interfaces of aggregation link of primary firewall, still firewall don't switch it state from passive to active or vice versa.

Is it firewall consider aggregate interface up or down when all interfaces of aggregation link up or down ?

Re: Aggregate interace behaviour

JayGolf — Wed, 03 Jan 2024 05:51:35 GMT

Hi @vishalrsshah ,

An AE is considered up if at least one of its member interfaces is "up" and considered "down" if all member interfaces are inactive.

Re: Aggregate interace behaviour

vishalrsshah — Wed, 03 Jan 2024 05:54:09 GMT

But in my case for ha failover not happening untill both members are not down.

Can you please help me what could be the reason.

Re: Aggregate interace behaviour

aleksandar.astardzhiev — Wed, 03 Jan 2024 10:20:43 GMT

Hi @vishalrsshah ,

Can you please share diagram how your devices are connected? Because it is not very clear what you are trying to achieve.

In additon - it is important to understand that PAN firewall will trigger failover when link is down, only if this interface is added in HA -> Link-Monitor. If the AE interface is not monitored by the HA, it will not trigger failover.

Re: Aggregate interace behaviour

vishalrsshah — Thu, 04 Jan 2024 06:56:53 GMT

Problem has been resolved. Thank you all.