topic Re: High Avaibility problem A\P in General Topics

High Avaibility problem A\P

Radmin_85 — Wed, 08 Nov 2017 12:57:41 GMT

There are two PA-500 firewalls in High Availability state A\P

After failover process the passive device become active but didnt pass the traffic.One possible reason which i suppose to be is the Gratious Arp packets are not send to the port of switch (cisco 3850) which is connected to passive device

because when we type show mac-address interface <<number>> there are no virtual mac address

are there any other possible suggestions?

Re: High Avaibility problem A\P

dburns — Mon, 13 Nov 2017 23:40:35 GMT

Did you happen to capture the GradARP packets on the passive device as it became active?

https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Capture-ARP-Packets-on-an-Interface/ta-p/55835

Re: High Avaibility problem A\P

reaper — Tue, 14 Nov 2017 09:11:34 GMT

@Radmin_85

if you force the Grat ARP, does it show up on your switch?

> test arp gratuitous interface

ethernet1/1 ethernet1/1

ethernet1/2 ethernet1/2

ethernet1/3 ethernet1/3

Re: High Avaibility problem A\P

Radmin_85 — Tue, 14 Nov 2017 13:56:45 GMT

I have found the problem.problem was in switch port
So i have now other question.is it any best way to check redundancy between two Qsfp links in PA 7050 devices?just unplug one ofnthem or how?