topic Re: HA Link Monitor Issue in General Topics

HA Link Monitor Issue

renzanjo11 — Wed, 04 Sep 2024 02:40:16 GMT

Hi everyone!

I am having some confusion on HA Link Monitoring and Failover. I did exactly the same thing with video courses and Palo alto document guide but it still doesn't work

For context, i am monitoring my eth1/2 and eth1/3 for failover. So i shut down the G0/0 interfaces of the routers directly connected to them and still there's no failover. I even configured the ethernet interface in Palo Alto to "down" state but no good. Am I missing something here?

Thank you in advance!

Re: HA Link Monitor Issue

emr_1 — Wed, 04 Sep 2024 02:51:17 GMT

I need two more information to answer your question.

Does the status of eth1/2 and 1/3 change to linkdown after you shutdown G0/0?

In another words, GREEN should be changed to RED as below.

What is the device status of peer device?

Fail-over occurs only when peer device is ready for fail-over which means peer device have to be "passive" if you are configuring active-passive.

If it is other status such as non-functional, suspended, etc., it does not fail over.

Re: HA Link Monitor Issue

renzanjo11 — Wed, 04 Sep 2024 03:31:32 GMT

Hi!

When I shut down the G0/0, my Palo Eth interfaces still shows green.

The status shows active-passive

HQ-FW as active and HQ-FW-2 as passive

Re: HA Link Monitor Issue

emr_1 — Wed, 04 Sep 2024 04:05:54 GMT

From reply for #1, that's the reason.

Link Monitoring keeps looking for link status of specified ports. To trigger it, you need to link-down that ports.

Try to unplug LAN cable on both ports, I believe it works. (icon will change to RED and fail-over should be occurred)

Re: HA Link Monitor Issue

renzanjo11 — Wed, 04 Sep 2024 05:42:33 GMT

I tried removing the link and the port still shows green. Is there something wrong with EVE-NG? I am trying this with EVE-NG.

Re: HA Link Monitor Issue

CosminM — Wed, 04 Sep 2024 06:00:33 GMT

Hi @renzanjo11

In any virtual environment (like EVE-NG) the link status will not be down even you shut down the other ending port of the link.

In such use cases, for VM firewalls in HA you can use Path Monitoring as failover trigger.

Re: HA Link Monitor Issue

emr_1 — Wed, 04 Sep 2024 06:05:21 GMT

Ah, you are using PA-VM, I thought it is related to hardware appliance.

Even I'm not familiar with EVE-NG, seems EVE-PRO provides the feature related to link state.

If this doesn't work, maybe using path monitoring is easier than link monitoring.

https://www.eve-ng.net/index.php/documentation/professional-cookbook/

Re: HA Link Monitor Issue

renzanjo11 — Wed, 04 Sep 2024 06:58:24 GMT

Hi @emr_1 , yep! This one is available on the pro i believe. But I resorted back to Path monitoring instead since I got a VM firewall. Much less of a headache 😄
Thank you very much!

Re: HA Link Monitor Issue

renzanjo11 — Wed, 04 Sep 2024 06:59:12 GMT

Hi @CosminM , indeed! I tried path monitoring. Gave me much better reconvergence and failover. This is noted for VM deployments. Thank you very much!