topic Re: Paloalto HA probem in Next-Generation Firewall Discussions

Paloalto HA probem

GabrielePiccini — Thu, 29 Sep 2022 08:53:32 GMT

Hello,

we have a few PA440 clusters where we are unable to activate HA. Software version is 10.1.6-h6.

As soon as we enable HA on first node, everything goes down (including internet access) and then the config gets rolled back (due to lost connectivity to panorama).

I cannot seem to find any hint in the system logs.

Has this happened to anyone?

Re: Paloalto HA probem

aleksandar.astardzhiev — Thu, 29 Sep 2022 22:03:33 GMT

Hi @GabrielePiccini ,

Are both firewalls currently managed by Panorama?

Are both firewalls receiving configuration from Panorama - are both assigned to same templates/device-group?

Are you using management interface for HA1? Are there any other PAN firewalls in the same network?

Are you able to login to the firewall while it is "down"?

One of the possible think I am imagine is that when enabling the HA, firewalls are trying to sync the config - if "Enable Config Sync" is enabled. This option will sync firewalls local config, Panorama pushed config is not synced between HA members - Panorama always push config to each member in the HA separately. So it is possible that syncing local config to actually telling the firewall to remove everything (since the local config is empty and everything is pushed from Panorama).

This could explain why FW loose connectivity with Panorama - assuming it is reaching it over OOB network, not passing over dataplane.

Another option would be that firewall is detecting another PAN HA cluster - if HA Group ID is the same. For that reason firewall is going to either non-functional or passive state and stop processing traffic.

Re: Paloalto HA probem

GabrielePiccini — Fri, 30 Sep 2022 06:46:05 GMT

Hello,

Are both firewalls currently managed by Panorama? YES

Are both firewalls receiving configuration from Panorama - are both assigned to same templates/device-group? YES

Are you using management interface for HA1? Are there any other PAN firewalls in the same network? NO, DEDICATED ONE. NO OTHER DEVICES ON NETWORK

Are you able to login to the firewall while it is "down"? YES, VIA PUBLIC IP ADDRESS

I also tried with "sync config" off. No matter what, even if firewall 2 has HA disabled, enabling HA on firewall 1 brings everything down.

Also , this occured on another installation (so it's not hardware related).

Thanks for reply

Re: Paloalto HA probem

GabrielePiccini — Tue, 04 Oct 2022 08:36:53 GMT

We finally managed to enable HA by starting from the secondiary node. Really strage.