LACP LINK DOWN FW PALO ALTO

H.McGoldrick — Thu, 21 Aug 2025 09:39:11 GMT

Hi,

I have a customer who's firewall unexpectantly failed over recently, looking at the logs before failover LACP links appeared to fail negotiation right before which triggers failover. Unfortunately HA logs don't stretch back enough!

Looking at the l2ctrid.logs (LACP log files on TSF)

See the bellow error constantly thrown leading up to failover:

2025-08-15 13:11:14.862 +0200 Warning: pan_lacp_worker_poll(pan_lacp_thread.c:631): lacp worker poll timer interval too short. now -1578154701, last -1578154701, diff 0

2025-08-15 13:11:14.862 +0200 Warning: pan_lacp_worker_poll(pan_lacp_thread.c:631): lacp worker poll timer interval too short. now -1578154701, last -1578154701, diff 0

2025-08-15 13:11:14.862 +0200 Warning: pan_lacp_one_sec_timer(pan_lacp.c:1758): lacp one-second timer interval too short. now -1578154701, last -1578154702, diff 1

2025-08-15 13:11:14.862 +0200 Warning: pan_lacp_worker_poll(pan_lacp_thread.c:631): lacp worker poll timer interval too short. now -1578154701, last -1578154701, diff 0

My question is could the system priority on the partner (see photos) be the issue behind the timer interval being to short?

Re: LACP LINK DOWN FW PALO ALTO

BPry — Sat, 23 Aug 2025 03:41:02 GMT

@H.McGoldrick,

You have a transmission rate mismatch. You have the firewall set to fast while your partner is set to slow which is not what you want, I would change the partner device so that it is also set to a fast transmission rate

topic Re: LACP LINK DOWN FW PALO ALTO in Next-Generation Firewall Discussions

LACP LINK DOWN FW PALO ALTO

Re: LACP LINK DOWN FW PALO ALTO