Passive device aggregate interface down

Jafar_Hussain — Mon, 11 Oct 2021 12:39:28 GMT

I have the firewall 3220 model in the 9.1.11 version in HA mode.

I can see all the aggregate interface in passive firewall is showing down. i want to know is this expected behaviour or not because I checked the below KB for some mode it is expected behaviour.

Aggregate Interface Down on Passive Device - Knowledge Base - Palo Alto Networks

moreover, my concern is at the last time the failover happen the passive device was not accessible as well as the traffic has stopped.

Re: Passive device aggregate interface down

BPry — Wed, 13 Oct 2021 04:18:33 GMT

@Jafar_Hussain,

By default, this is expected on a passive device. As the article that you have linked mentions, you can get the passive node to participate in LACP pre-negotiation by enabling it on the AE interface/s by going to the lamp tab and setting passive-pre-negotiation.

This allows the passive interfaces to participate in LACP communication, but still drops the rest of the traffic on the passive node.

Without knowing more about your network and configuration, it's hard to say why the failover would make the passive node unaccessible and cause all of your traffic to stop. You could have run into an LACP issue and your switch could have blocked the ports, or a number of other things that could cause outages.

Re: Passive device aggregate interface down

Jafar_Hussain — Wed, 13 Oct 2021 11:30:58 GMT

@BPry

I have configured AE1 group with interface ethernet 1/17 and ethernet 1/18

once I took the output for the active and passive that time I found the key for the partner I am not able to see on the passive firewall. below is the output:-

Active firewall output:-

***************************************************

AE group: ae1

Members: Bndl Rx state Mux state Sel state

ethernet1/17 yes Current Tx_Rx Selected

ethernet1/18 yes Current Tx_Rx Selected

Status: Enabled

Mode: Active

Rate: Slow

Max-port: 8

Fast-failover: Disabled

Pre-negotiation: Enabled

Local: System Priority: 32768

System MAC: x:x:x:x

Key: 16

Partner: System Priority: 32768

System MAC: x:x:x:x

Key: 11

Port State

--------------------------------------------------------------------------------

Interface Port

Number Priority Mode Rate Key State

--------------------------------------------------------------------------------

ethernet1/17 80 32768 Active Slow 16 0x3D

Partner 306 32768 Active Slow 11 0x3D

ethernet1/18 81 32768 Active Slow 16 0x3D

Partner 562 32768 Active Slow 11 0x3D

Port Counters

--------------------------------------------------------------------------------

Interface LACPDUs Marker Marker Response Error

Sent Recv Sent Recv Sent Recv Unknown Illegal

--------------------------------------------------------------------------------

ethernet1/17 111857 120904 0 0 0 0 0 0

ethernet1/18 111855 120931 0 0 0 0 0 0

*************************************************************************************

LACP output of the passive firewall"-

***********************************************************

AE group: ae1

Members: Bndl Rx state Mux state Sel state

ethernet1/17 no Defaulted Detached Unselected(Peer not detected)

ethernet1/18 no Defaulted Detached Unselected(Peer not detected)

Status: Enabled

Mode: Active

Rate: Slow

Max-port: 8

Fast-failover: Disabled

Pre-negotiation: Enabled

Local: System Priority: 32768

System MAC: x:x:x:x

Key: 16

Partner: System Priority: 0

System MAC: 00:00:00:00:00:00

Key: 0

Port State

--------------------------------------------------------------------------------

Interface Port

Number Priority Mode Rate Key State

--------------------------------------------------------------------------------

ethernet1/17 80 32768 Active Slow 16 0x45

Partner 0 0 Passive Slow 0 0x00

ethernet1/18 81 32768 Active Slow 16 0x45

Partner 0 0 Passive Slow 0 0x00

Port Counters

--------------------------------------------------------------------------------

Interface LACPDUs Marker Marker Response Error

Sent Recv Sent Recv Sent Recv Unknown Illegal

--------------------------------------------------------------------------------

ethernet1/17 111943 0 0 0 0 0 0 0

ethernet1/18 111874 0 0 0 0 0 0 0

*************************************************************************************************

On the passive firewall output for the AE1 :- I noticed that the prenegotiation is enabled but I didn't get the partner MAC address even I didn't get the partner key for the ethernet 1/17 and ethernet 1/18.

One more point I highlight in the port counter LACPDU's the packets is sending but didn't receive any output.

I would like to know, is this expected or do I need to check something on this.

Re: Passive device aggregate interface down

Jafar_Hussain — Tue, 26 Oct 2021 13:26:17 GMT

@BPry

The device was faulty. we replace the device.

Re: Passive device aggregate interface down

Maria-Victoria — Fri, 22 Apr 2022 16:29:40 GMT

hello is possible to know how was checked that the fw was faulty? I have the same problem

topic Re: Passive device aggregate interface down in General Topics

Passive device aggregate interface down

Re: Passive device aggregate interface down

Re: Passive device aggregate interface down

Re: Passive device aggregate interface down

Re: Passive device aggregate interface down