topic Re: Suspended HA partner becomes active in General Topics

Suspended HA partner becomes active

LCMember1959 — Mon, 10 Oct 2016 10:11:31 GMT

We are in the process of setting up HA between two PA-5050 running PANOS 6.1.14. After configuring everything and testing failover in our main data center we performed "Suspend local device" on the passive node and shut it down to move it to our secondary site. After it was moved there and powered on we started to connect the various interfaces. This caused a major outage in our network, and when I connected to the console port on the (presumed) suspended firewall I saw that it had gone active. Is this a bug in PAN-OS, or did we miss a step somewhere?

Re: Suspended HA partner becomes active

TranceforLife — Mon, 10 Oct 2016 10:46:10 GMT

Suspend option will be "reset" after reboot. How about your preemption option on the "passive" node after you fire it up?

https://live.paloaltonetworks.com/t5/Learning-Articles/Understanding-Preemption-with-the-Configured-Device-Priority-in/ta-p/53398

Thx,

Myky

Re: Suspended HA partner becomes active

LCMember1959 — Mon, 10 Oct 2016 10:52:35 GMT

Device priority on the firewall in our main data center is set to 100 and the other is set to 111. Preemption is enabled. I am guessing when the passive partner booted up without network connectivity and no longer suspended it assumed that the active partner was down and made itself active. Then the interfaces were connected and we got a split brain scenario.

Re: Suspended HA partner becomes active

TranceforLife — Mon, 10 Oct 2016 10:59:32 GMT

Agreed. So firewall should recover from the (split brain scenario) after connectivity has been established. We had a similar situation.

Re: Suspended HA partner becomes active

MP18 — Thu, 04 Apr 2019 01:41:20 GMT

Do you mean that after sometime suspended PA which become active changed the state to passive once network was restored

automatically?