topic Re: HA issues in General Topics

HA issues

niuk — Fri, 29 Jul 2016 01:03:02 GMT

I have 5060 pair (pan1 and pan2) with 7.1.2 in HA. Whenever pan2 interfaces are up, not shutdown, sooner or later we experience issues. It doesn’t matter if pan2 is active or passive. Could it be h/w ? Config is in sync

Re: HA issues

pulukas — Fri, 29 Jul 2016 10:39:35 GMT

In Active/Passive the links will show up on the passive node but no traffic will pass until a failover event.

In Active/Active mode the link is up and traffic will pass.

If you are sure that traffic is passing a passive node link and there are no failover events in the logs, I would open a case with TAC to investigate. It would likely be a software bug.

Re: HA issues

niuk — Fri, 29 Jul 2016 13:25:45 GMT

I have case opened, asking for RMA. If it is s/w bug why issue never happens on pan1 ? Configuration is in sync, and apparanetly same s/w too. Config of ports on the switch is identical.

Re: HA issues

BPry — Fri, 29 Jul 2016 15:18:50 GMT

Just because the same information/configuration is present on identical software doesn't mean that their can't be something wrong with the underlying OS of the firewall. You could have a process that isn't behaving correctly or a kernal that didn't take a software update as expected that could be causing the issue. It's the same on a computer, just because they do the same thing and are the same model doesn't mean that they can't have issues that the other isn't experiancing.

Re: HA issues

pulukas — Sat, 30 Jul 2016 12:25:27 GMT

The nature of the issue makes it far more likely to be a bug in PanOS than a hardware failure. The HA software is what allows the link to be up but the traffic to no longer be accepted. Generally for a port hardware level failure we would see input/output errors or a failure to pass traffic at all. I feel pretty confident that if there is an issue the issue will be a bug in the PanOS and you will need to get either a service release or upgrade to solve the problem.

It could also be some configuration issue on the device that simply needs to be adjusted to work properly.

Keep us updated on the case.

Re: HA issues

michelealbrigo — Sun, 31 Jul 2016 09:29:19 GMT

You could try with an active/standby setup and different settings in Device > High Availability > General > Active/Passive settings, maybe, until your ticket is resolved and you can go with the setup you initially wanted to implement. Here you can configure interface behavior on passive member when you are in an active/passive setup. I have 2 HA-pairs, and with our design we have no issues leaving this to auto, but your situation might be a lot different.