topic Re: PA-7050 LACP causing delay in fail-over times in General Topics

PA-7050 LACP causing delay in fail-over times

Gun-Slinger — Wed, 30 Sep 2015 15:15:22 GMT

We have an HA A/P PA-7050 cluster running 7.0.2 with QNPC (40G). The 40G links are bundled in AE1 with LACP enabled. We noticed during testing that LACP causes 8-10 ping loss during a fail-over event. With LACP disabled we have a 1 ping loss during fail-over events.

The LACP settings we have are the following:

The remote side has been verified to reflect a compatible setup to this. Has anyone else noticed this issue?

Re: PA-7050 LACP causing delay in fail-over times

cpainchaud — Wed, 30 Sep 2015 15:38:21 GMT

By playing with switch side LACP and Spanning-Tree timers, you can probably achieve 1-4 seconds failover.

Yet dont look for instant/no loss failover with LACP on PANOS, this may come in next release. If you need absolutly transparent/least impact then switch back to non-LACP aggregation.

Re: PA-7050 LACP causing delay in fail-over times

Gun-Slinger — Wed, 30 Sep 2015 15:52:53 GMT

Thanks cpainchaud,

We will be disabling LACP until this feature is optimized.

Re: PA-7050 LACP causing delay in fail-over times

BenjAudy.MTL — Wed, 30 Sep 2015 16:01:28 GMT

Hi,

I'm currently configuring an aggregate link (2x 10Gb) to a Nexus switch with LACP enabled and we have the exact same problem. What I don't understand is that the LACP negotiation seems fast enough, but then traffic does not go through for a couple of seconds. I'll check with the telecom team if they can tweak some timers as suggested.

Benjamin

Re: PA-7050 LACP causing delay in fail-over times

BenjAudy.MTL — Wed, 30 Sep 2015 16:03:55 GMT

Hi,

Have you heard something to that effect (instant/no loss failover in next release)?

Benjamin

Re: PA-7050 LACP causing delay in fail-over times

cpainchaud — Wed, 30 Sep 2015 16:05:38 GMT

As usual, this kind of info cannot be disclosed publicly. Please reach your PAN representative to obtain such aswer.

Very sorry about that 🙂

Re: PA-7050 LACP causing delay in fail-over times

BenjAudy.MTL — Wed, 30 Sep 2015 16:14:38 GMT

No problem, I'll check with my SE.

Re: PA-7050 LACP causing delay in fail-over times

Sly_Cooper — Wed, 05 Oct 2016 19:03:54 GMT

Exact same issue for me as well. Currently testing PA-7050 with Cisco Nexus, 2x10G LACP. With PAN HA interface as Auto vs. Shutdown, there is zero to one ping drop. I had tested even with voice call going on and there is no service disruption. With LACP, it is 8-12 ping drops. Even after the peer is detected, it takes time to actually pass the traffic. I will check with my SE as well.

What is the PAN LACP recommended mode, Active or Passive?

Re: PA-7050 LACP causing delay in fail-over times

Anon1 — Fri, 07 Oct 2016 19:21:31 GMT

Do you have version 7.1.x ? There is a new feature to have LACP active on passive firewall node (Enable LACP active pre-negotiation for an HA passive firewall):

https://www.paloaltonetworks.com/documentation/71/pan-os/newfeaturesguide/networking-features/lacp-and-lldp-pre-negotiation-on-an-ha-passive-firewall#19978