https://live.paloaltonetworks.com/t5/next-generation-firewall/pa-1410-secondary-ip-unreachable/m-p/1205964#M5454 <P>I have an issue where the secondary IP-address is unreachable on PA-1410.<BR />The deployment looks like.<BR />2 PA-1410 HA (active/passive)</P> <P>Aggregated layer 3 interface with sub-interface (vlan tagged)</P> <P>Management profile allow ping only</P> <P>Firewall policy is allowing ping in- and outbound</P> <P>Advanced Routing is enabled</P> <P>&nbsp;</P> <P>I tested the troubleshooting tool ping with source is the secondary IP. <BR />The primary IP can ping and is reachable.</P> <P>&nbsp;</P> <P>I have compared the configuration with other Palo Alto deployments (PA-850) and there was no issue.</P> <P>&nbsp;</P> <P>I can see that in ARP table the IP address is Incomplete, but it should not be resolved by ARP at all. Since it is an IP of the FW itself.</P> Tue, 28 Jan 2025 09:23:18 GMT O.Rietbrock 2025-01-28T09:23:18Z https://live.paloaltonetworks.com/t5/next-generation-firewall/pa-1410-secondary-ip-unreachable/m-p/1205964#M5454 <P>I have an issue where the secondary IP-address is unreachable on PA-1410.<BR />The deployment looks like.<BR />2 PA-1410 HA (active/passive)</P> <P>Aggregated layer 3 interface with sub-interface (vlan tagged)</P> <P>Management profile allow ping only</P> <P>Firewall policy is allowing ping in- and outbound</P> <P>Advanced Routing is enabled</P> <P>&nbsp;</P> <P>I tested the troubleshooting tool ping with source is the secondary IP. <BR />The primary IP can ping and is reachable.</P> <P>&nbsp;</P> <P>I have compared the configuration with other Palo Alto deployments (PA-850) and there was no issue.</P> <P>&nbsp;</P> <P>I can see that in ARP table the IP address is Incomplete, but it should not be resolved by ARP at all. Since it is an IP of the FW itself.</P> Tue, 28 Jan 2025 09:23:18 GMT https://live.paloaltonetworks.com/t5/next-generation-firewall/pa-1410-secondary-ip-unreachable/m-p/1205964#M5454 O.Rietbrock 2025-01-28T09:23:18Z