topic Re: sync issues in General Topics

sync issues

jdprovine — Wed, 16 Aug 2017 14:14:18 GMT

My HA pair went into split brain so I rebooted the secondary and now they will not sync

Re: sync issues

TranceforLife — Wed, 16 Aug 2017 16:09:04 GMT

Are they still able to communicate over the control plane?

Re: sync issues

jdprovine — Wed, 16 Aug 2017 16:33:19 GMT

After hitting sync peer many times they finally worked and synced

Re: sync issues

OtakarKlier — Wed, 16 Aug 2017 21:18:58 GMT

Hello,

Do you have 'Device Priority' enabled? This does help with the split brian issues sometimes.

Election Settings

Specify or enable the following settings:

•	Device Priority—Enter a priority value to identify the active firewall. The firewall with the lower value (higher priority) becomes the active firewall (range is 0–255) when the preemptive capability is enabled on both firewalls in the pair.

Regards,

Re: sync issues

TranceforLife — Wed, 16 Aug 2017 21:56:25 GMT

The problem is if firewalls are unable to communicate (exchange "Heartbeat" messages) then each device assumes active role.

EDIT:

Ohh misread your message. Yes, you are right. I thought we are talking about preemption

Re: sync issues

OtakarKlier — Wed, 16 Aug 2017 21:54:06 GMT

Hello,

Yes that is true, however the split brain arises when communication is restored. So this should help solve that issue, correct?

Regards,

Re: sync issues

Remo — Wed, 16 Aug 2017 23:30:50 GMT

The device priority does not help you in split-brain situations. Split-brain is, as described by @TranceforLife, when the firewalls cannot communicate, so both peers assume the other one is down -> both change to active state.

The device priority is primary needed if you have one firewall which should, in most cases, handle the traffic. So in combination with preemptive mode, this makes sure that after a problemsituation is solved, the firewall with the higher priority (lower value) will change back to active.

If you don't care which firewall is active, there is actually no need to set different values (even if I recommend to do it anyway), because if both firewalls have the same value, the one with the lowest mac address will become the active clustermember.

@jdprovine

If you need to reboot the firewall after a split-brain to restore full functionality of the cluster, this sounds to me like a bug ... do you have PAN-OS 8.0.1 running?

Re: sync issues

jdprovine — Thu, 17 Aug 2017 15:58:09 GMT

@Remo

no i am currently on os 7.1.10, I think we are going to try to connect the heartbeat via fiber without running through switches or any other devices which seem to be the main cause in our situtation.