topic Re: HA1 showing down in General Topics

HA1 showing down

amy.hazelwood — Thu, 11 Jun 2020 14:12:41 GMT

HA1 is showing down, but HA1 Backup and HA2 are showing up. FWs recently configured by contractor who has left. Configuration appears correct. Any suggestions?

Re: HA1 showing down

rmfalconer — Thu, 11 Jun 2020 15:02:16 GMT

Was it ever up? Any changes if it was up? Have you tried a cable replacement?

Are they directly connected or going through a switch?

You said the config looks fine. Did you verify the ha1 IP addresses on both members are in the same subnet and correctly defined on each other?

Re: HA1 showing down

amy.hazelwood — Thu, 11 Jun 2020 18:53:47 GMT

To my knowledge it was never up. The contractor who set it up left abruptly and we never had time to circle back and discuss. He did say that he needed to change something but didn't say what and from what I can tell the HA config was done correctly. The five pairs are directly connected, however two of the pairs are on different subnets. I'm not sure why he set them up differently. The Peer HA1 IP address on the active Palo is the IP of the passive Palo, and the Peer HA1 IP address of the passive Palo is the IP of the active Palo - is that what you are referring to?

Re: HA1 showing down

rmfalconer — Thu, 11 Jun 2020 20:38:21 GMT

What are the 5 pairs that are connected? HA1-a, HA1-b, hsci and the Aux ports? What is each being used for?

What model firewalls are these?

In the CLI, does that HA interface show up?

Are the HA1 addresses on the same subnet?

Re: HA1 showing down

amy.hazelwood — Thu, 11 Jun 2020 22:31:37 GMT

What are the 5 pairs that are connected? HA1-a, HA1-b

What model firewalls are these? PA-850

In the CLI, does that HA interface show up? show interface command will not work in the CLI

Are the HA1 addresses on the same subnet? Yes

Re: HA1 showing down

rmfalconer — Thu, 11 Jun 2020 23:30:02 GMT

I don't think the 850 has A and B for HA.

If you do 'show interface ha1', there's no output? Are you using an account with the right permissions?

Re: HA1 showing down

amy.hazelwood — Fri, 12 Jun 2020 19:01:47 GMT

Ok yes, my error, I do see the HA1 interface.

Re: HA1 showing down

rmfalconer — Fri, 12 Jun 2020 20:20:42 GMT

Does it show up or down? If it's down, probably a cabling problem.

Re: HA1 showing down

amy.hazelwood — Mon, 15 Jun 2020 14:21:29 GMT

How do I tell from the CLI output from "show interface ha1" if it is up?

Re: HA1 showing down

rmfalconer — Mon, 15 Jun 2020 14:48:19 GMT

show interface ha1-a

Name: ha1-a, ID: 5
Link status:
Runtime link speed/duplex/state: 1000/full/up
Configured link speed/duplex/state: auto/auto/auto

Re: HA1 showing down

amy.hazelwood — Mon, 15 Jun 2020 15:14:12 GMT

Thank you for the clarification. Here is what I have:

Name: ha1, ID: 5
Link status:
Runtime link speed/duplex/state: unknown/unknown/unknown
Configured link speed/duplex/state: auto/auto/auto

Re: HA1 showing down

rmfalconer — Mon, 15 Jun 2020 15:42:57 GMT

Looks like a layer 1 problem. Maybe the cable is bad or it's connected in the wrong place on one side.

Even if the HA config or IP address info is wrong, it would show up if the physical connection is good.

Re: HA1 showing down

amy.hazelwood — Wed, 17 Jun 2020 18:09:06 GMT

Ok, I work remotely and I've having trouble getting someone to look at the cabling for me. I'll keep you posted. Thank you.

Re: HA1 showing down

amy.hazelwood — Wed, 17 Jun 2020 18:22:09 GMT

Another question:

Under Network-Interfaces the link state shows up, but under the Dashboard the HA1 shows down. They have the same IP - I feel like there is something I am not understanding about his config...

Re: HA1 showing down

rmfalconer — Wed, 17 Jun 2020 19:11:44 GMT

What interface is being used for HA1? The dedicated HA interfaces don't appear in Network-Interfaces.

You can define data plane interfaces for HA use but that's not typically done on models that have the dedicated HA interfaces.

Re: HA1 showing down

amy.hazelwood — Wed, 17 Jun 2020 20:48:55 GMT

From what I can see (online not onsite) is one HA is ethernet1/7 and the other HA is ethernet1/8, both up.

Re: HA1 showing down

rmfalconer — Wed, 17 Jun 2020 22:17:35 GMT

On Device-High Availability, what interfaces are shown for each backup link?

Re: HA1 showing down

amy.hazelwood — Thu, 18 Jun 2020 12:07:10 GMT

Backup Peer HA1 IP address is .30

Control Link (HA1Backup) is .29

Re: HA1 showing down

amy.hazelwood — Thu, 02 Jul 2020 01:00:22 GMT

So I changed around the configuration to what I thought it should be vs. what the contractor put in and I was able to get the HA1 interface up but the HA1 backup is down.

1 - He set Management as the HA1 Control Link and I set it to the HA1 ethernet interface IP.

2 - He set the Peer HA1 IP as the Peer's Management IP and I set it to the Peer's HA1 ethernet interface.

3 - He set the Backup Peer HA1 IP as the Peer's HA1 ethernet interface IP and I set it to the Peer's HA2 ethernet interface, which showed down after I changed it.

3 - He set the Control Link HA1 Backup as the HA1 ethernet interface IP and I set it to None.

4 - We both set the HA2 Datalink to the HA2 ethernet interface IP, which has always shown up.

5 - We both set the HA2 Datalink Backup to None.

I know the PA-850s HA setup must be configured differently than the PA-200s HA setup, but I cannot find a config guide specific to the PA-850s.

Re: HA1 showing down

rmfalconer — Fri, 10 Jul 2020 20:02:28 GMT

Since you have Control Link HA1 Backup set to none, the Backup Peer HA1 IP Address should be blank. No need for an IP address if it's unused. If you remove the Backup Peer HA1 IP Address, then the HA widget should remove the HA1 Backup option.

If you want to use the HA1 Backup, you can use the management interfaces of each firewall. Set the port configuration to management and the Backup Peer HA1 IP Address to the peer management IPs. Or you could use data plane interfaces set to the HA type.