topic Re: PA L2 interface ARP problem in General Topics

PA L2 interface ARP problem

DiogoFG — Mon, 08 Nov 2021 16:44:46 GMT

Hi,

I have a PA with two switches connected to the PA via L2 interface, in trunk. The same switches have a trunk between them.

PA---SW1

| |

SW2--|

So far so good, STP works and the network is stable. If one of the links between switch and PA falls (exemple PA to SW1) everything works too, all the traffic is redirect to PA via SW2, but as soon as link is became ok again, the Palo Alto ARP table does not refresh the Management VLAN and PA continues to think that the sw1 IP is seen by sw2.

Has anyone felt this behavior?

Regards

Re: PA L2 interface ARP problem

OtakarKlier — Mon, 08 Nov 2021 21:44:18 GMT

Hello,

Do you have the PAN in HA, e.g. are there two of them? Also why have the two switches trunked?

Regards,

Re: PA L2 interface ARP problem

TomYoung — Mon, 08 Nov 2021 22:47:41 GMT

Hi @DiogoFG ,

It looks like a STP design issue. A say "design" because STP is working, just not as you expected.

The interface shown by "show arp all" is there for convenience. It is not resolved by ARP but rather reflects the L2 forwarding table of "show mac all".
The PA does not participate in STP, but rather forwards the BPDUs to assist in loop prevention. So, the STP topology looks like SW1=SW2 (the = represents 2 links). It sounds like once the SW1-PA link goes down, once it comes back up it stays in STP blocking mode. You can confirm what port is in STP blocking mode on the switch.
You should design the blocked port according to desired traffic flow. If you want the direct link between SW1 and SW2 to always be in blocking state (when all links are up), then adjust your STP cost or priority accordingly on SW1 or SW2.

Thanks,

Tom

Re: PA L2 interface ARP problem

DiogoFG — Tue, 09 Nov 2021 07:59:54 GMT

Hi,

Yes there are two of them, with HA in Acive-Passive configuration. The trunk between switches is for redundancy reasons.

Regards,