topic Re: F5 failover connected behind PA in General Topics

F5 failover connected behind PA

raji_toor — Fri, 31 May 2019 16:59:00 GMT

We have two F5 devices configured as active standby behind PA. The issue is on failover F5 failover ARP table on the PA is not updated quickly enough for smooth transition. Is there a way to mitigate this problem and increase ARP update time for that interface only.

Re: F5 failover connected behind PA

BPry — Fri, 31 May 2019 20:13:40 GMT

@raji_toor,

From the CLI you can set the ARP cache timeout by issueing the command set system setting arp-cache-timeout <value> with the minimum being 60 seconds and the maximum being 65535 seconds. This of course is system wide and can't be adjusted for just one interface.

If you could script something to trigger when your F5 device logs a failover event, in a Slunk for example, you could utilize the API to clear the arp on the interface by issuing the clear arp <interface> command via the API. /api/?type=op&cmd=<clear><arp>interface</arp</clear>

Re: F5 failover connected behind PA

hshawn — Fri, 31 May 2019 20:32:57 GMT

We have the same setup (using default arp cache timeouts) and we do not see this issue. everything fails over smoothly

p.s. to see your current arp cache timeout use: show arp all

it appears there is a bug with show system setting arp-cache-timeout (valid command seen here: https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-new-features/networking-features/arp-cache-timeout) because when I try that one I get an error but show arp all gives me the info

Re: F5 failover connected behind PA

raji_toor — Fri, 31 May 2019 21:58:51 GMT

@hshawn Do you use mac masquerading on F5