topic ha2 keep alive in General Topics

ha2 keep alive

simsim — Sat, 15 Apr 2017 14:59:23 GMT

Hi,

I am getting the below message ,there is no specific interval (around 30 min)

it countinously happens from three days .

What is the action need to be taken

HA Group 1: Local HA2 keep-alive up
04/15 14:57:47

HA Group 1: All HA2 keep-alives are down
04/15 14:57:39

HA Group 1: Local HA2 keep-alive down
04/15 14:57:39

How do i begin the troubleshooting ?

This will cause any issue ?

I could see the dataplane cpu going very high right after the keep alive up ?

What exactly ha2 doing

during this time , i can see the link ha2 is up

Thanks

Re: ha2 keep alive

TranceforLife — Sat, 15 Apr 2017 18:11:28 GMT

Hey,

You can find an answer by checking the page 8 of the below document:

https://live.paloaltonetworks.com/twzvq79624/attachments/twzvq79624/documentation_tkb/543/2/HA_Failover_Optimization-RevC.pdf

Re: ha2 keep alive

simsim — Sun, 16 Apr 2017 06:46:26 GMT

Hi,

the deployment is active active ,

Both PA was showing the same error before the seondary pa rebooting

HA Group 1: Local HA2 keep-alive up
04/15 14:57:47

HA Group 1: All HA2 keep-alives are down
04/15 14:57:39

HA Group 1: Local HA2 keep-alive down
04/15 14:57:39

after rebooting the secondary showing the below logs but the primary showing the same above .

HA Group 1: Local HA2 keep-alive down
04/15 18:24:40
HA Group 1: All HA2 keep-alives are down
04/15 18:24:40
HA Group 1: Peer HA2 keep-alive down

I am monitoring the ha2 interface on switch side , but there is no trace for link down status

Thanks

Re: ha2 keep alive

Sethupathi — Tue, 02 Jul 2019 13:58:17 GMT

Hi,

I can't access this document, Please help us with a new one or a any suggestion?

Regards,

Sethupathi M

Re: ha2 keep alive

Sethupathi — Tue, 02 Jul 2019 14:05:55 GMT

Hello Team,

I'm also getting same,

Problem description:

1) Observed data plane under severe load message in the system logs.

2) Within a second, got “All HA2 keep alives are down” message

3) HA keep alives were down for exactly 4 seconds.

Can anyone suggest what is the troubleshoot methods and how can I findout a RCA.?

Could you help us here.

Thanks & Regards,

Sethupathi M

Re: ha2 keep alive

BPry — Tue, 02 Jul 2019 14:24:08 GMT

@Sethupathi,

What ports are you utilizing for HA2?

Re: ha2 keep alive

Brandon_Wertz — Tue, 02 Jul 2019 17:17:26 GMT

@BPry wrote:
@Sethupathi,
What ports are you utilizing for HA2?

I was wondering the same. What is your hardware type @Sethupathi @simsim ? If you're not using the dedicated HA2 port and the box is under heavy utilization the HA2 port and it's functionality will occur via the DP. With the DP being under load it's possible HA functionality could be affected.

Re: ha2 keep alive

Sethupathi — Tue, 02 Jul 2019 19:25:26 GMT

Hi Brandon,

I'm having PA-5050.

Regards,

Sethupathi M

Re: ha2 keep alive

OtakarKlier — Tue, 02 Jul 2019 19:31:32 GMT

Hello,

Ifthe two are not connected directly, i.e. something like a switch or router in between the two PAN's, I would suggest also setting up HA1 and HA2 backups as a best pratice.

Regards,

Re: ha2 keep alive

Sethupathi — Thu, 04 Jul 2019 10:34:12 GMT

Hi Team,

Having dedicated HA ports and which is directly connected.

It has been noticed that , Total management plane consumed disk space i.e. root partition is almost full.

Filesystem Size Used Avail Use% Mounted on

/dev/md3 3.8G 3.3G 295M 92% /

/dev/md5 7.6G 4.1G 3.1G 58% /opt/pancfg

/dev/md6 3.8G 2.0G 1.7G 55% /opt/panrepo

tmpfs 2.0G 116M 1.9G 6% /dev/shm

cgroup_root 2.0G 0 2.0G 0% /cgroup

/dev/md8 198G 44G 144G 24% /opt/panlogs

tmpfs 12M 0 12M 0% /opt/pancfg/mgmt/lcaas/ssl/private

Note:I'm having PA-5050

Could any one help us here.

Regards,

Sethupathi M

Re: ha2 keep alive

BPry — Fri, 05 Jul 2019 02:17:17 GMT

@Sethupathi,

I wouldn't be worried about the dev/md3 partition being at 92%, that wouldn't cause your HA issues at all. If you are utilizing the dedicated HA1 and HA2 ports and not configuring another interface as a high-availability interface, high dataplane utilization shouldn't cause the HA interfaces to drop out. I would open a ticket with TAC so they can look at the associated logs and see exactly what was going on at the time the interfaces dropped.

Re: ha2 keep alive

joris_vd — Fri, 15 Nov 2019 08:28:28 GMT

Hi,

I'm seeing the same issue here. We have an active/passive 5250 cluster.

We are running PANOS8.1.9

All HA links are directly connected.
cluster node 1:

cluster node 2:

Is this a known issue?

Thanks

Re: ha2 keep alive

Ryan_Thompson — Thu, 13 Feb 2020 03:08:50 GMT

Hi @joris_vd,

Did you ever find a solution to the issue you mentioned? I'm currently running into a very similar issue with a 5050 active-passive cluster running on PAN-OS 8.1.10. We've been working with TAC for the past few days and haven't had any resolution. Any info would be much appreciated.

Thanks,

Re: ha2 keep alive

joris_vd — Thu, 13 Feb 2020 08:03:30 GMT

Hi Ryan,

As it only happened once we closely kept monitoring the cluster behavior in case it would re-occur...but it didn't. No support ticket was opened.

I will keep you posted if it happens again. We are still running PANOS 8.1.9.

Please let me know the outcome of the support ticket.

Best regards

Joris

Re: ha2 keep alive

fb-pan — Fri, 21 Feb 2020 06:07:06 GMT

Hi Ryan

Did you guys found a resolution for this?

I see the same issue with PANOS 8.1.10 with a PA3220 A/P.

Regards

Fabian

Re: ha2 keep alive

joris_vd — Fri, 21 Feb 2020 08:34:35 GMT

Hi Fabian,

No, not yet.

It did occur just once on our A/P firewall cluster.

I'll let you know if it happens again.

Best regards

Joris

Re: ha2 keep alive

dmitriy.yasnovsky — Thu, 16 Sep 2021 11:02:03 GMT

Hi people.

Our customer faced the same problem in PAN-OS 9.1.9. It uses the PA-820 models in active-passive mode and dedicated HA ports.