topic Re: arp issue with PA Active/Active in General Topics

arp issue with PA Active/Active

Alex_Samad — Thu, 11 May 2017 21:08:10 GMT

2 PA-3060's, setup in Active / active

I have a vlan 213 with 10.172.213.0/24 assigned to it

I have .2 and .3 assigned to the PA's and .1 assigned as a HA Virtual ip .

I also have 3 virtual machines, app1 app2 app3.

app1 and app3 can arp 10.172.213.1, app2 can't

these vm's are on the same host, and a few hours ago app2 could arp .1 (DGW).

last time I fixed it by rebooting both PA.

also I have tried (and it worked), but shutting down the Active state of each PA one by one and letting things fail over .. so shutdown pa1 wait then turn on pa1 and turn off pa2 and wait and then turn on pa2.

How can I diagnose this problem ??

What am I missing ?

Re: arp issue with PA Active/Active

BPry — Fri, 12 May 2017 13:19:17 GMT

This is a pretty common issue in an Active/Active configuration and there are a lot of potential problems that you could be hitting; this type of thing is why Active/Active configuration is really not advised unless you are doing a large amount of async routing.

Re: arp issue with PA Active/Active

Alex_Samad — Fri, 12 May 2017 23:06:55 GMT

Okay, I can accept Active/Active is complicated. What I can't accept it that it just broken. if it work for big environments then it should work for all environments.

Because this is a trial, I want to investigate what the issue is.

I have done packet captures on both pa's and I can see the arp request is being dropped by both PA's ??? thats very strange

If this is a common issue, then maybe the PA's are not for me. this seems like a fairly standard easy setup. My Aristra switches can do vrrp across 2 nodes for a distributed DGW.

When I disable one pa1 from the active active setup it all works fine..

Re: arp issue with PA Active/Active

Alex_Samad — Thu, 18 May 2017 06:31:40 GMT

Its an interaction between OSPF and active active.

The primary PA inserts a /32 into the routing table so it is the only device that responds to pings but OSPF takes that and redistributes it to the other PA, once that OSPF route is in the table it stops responding to arp’s !!!!

Solution I have to filter out all the VIP address from OSPF

Interesting ....