topic Re: Incoming Traffic failed in Active Active HA in General Topics

Incoming Traffic failed in Active Active HA

mbs.admin — Fri, 25 May 2012 05:36:12 GMT

Hi,

I setup active/active configuration and everything seems to be working. We test HA by powering off the other peer and vice versa. All outgoing traffic are working as expected. But, we notice that we're not receiving incoming traffic if one of the PAN fails. I configured NAT and assign the active/active HA binding to both.

Please help.

Thanks,

Rex

Re: Incoming Traffic failed in Active Active HA

rmonvon — Fri, 25 May 2012 14:10:06 GMT

Hi...You may want to double-check your dest (inbound) NAT as the dest NAT should only be binded to the active primary device. Please refer to this document for more info.

Configuring Active Active HA: https://live.paloaltonetworks.com/docs/DOC-1756

Re: Incoming Traffic failed in Active Active HA

mbs.admin — Fri, 25 May 2012 16:28:24 GMT

Thanks for the reply rmonvon.

I tried to bind it on the active primary device and also tried to use both but none of it is working. Everytime I reboot the device, incoming traffic never comes back until the rebooted is back online.

Re: Incoming Traffic failed in Active Active HA

rmonvon — Fri, 25 May 2012 16:30:27 GMT

If you suspend the secondary device & keep primary running, does it work?

Re: Incoming Traffic failed in Active Active HA

mbs.admin — Fri, 25 May 2012 16:34:19 GMT

This is weird. Everytime I reboot the secondary device, incoming traffic stops. But if I reboot the primary device, both incoming and outgoing is normal. I follow the instructions in tech-note for HA.

Re: Incoming Traffic failed in Active Active HA

rmonvon — Fri, 25 May 2012 16:40:18 GMT

That is odd. Can you monitor the ARP cache/MAC table on your switch/router and see what happens to the ARP/MAC entry for the NAT IP. It should reflect the change as the HA failover and recover.