topic Re: HA Configuration on PA-3220 - HA1 is UP but HA1 Backup is Down in General Topics

HA Configuration on PA-3220 - HA1 is UP but HA1 Backup is Down

aarato — Fri, 14 Dec 2018 18:09:38 GMT

I have both PA-3220 HA1-A and HA1-B links connected back to back to each other with a previously verified cable but only HA1 is coming up greeen while HA1 Backup is showing down. The HA1-B interface LEDs on both PA-3220 show green.

Any feedback or suggestion is greatly appreciated.

PassiveHA Setup BHA Setup AActive

Re: HA Configuration on PA-3220 - HA1 is UP but HA1 Backup is Down

rodvand_de — Sun, 16 Dec 2018 23:21:04 GMT

What release are you on? In 8.1.4 there's a bug involving the HA1-B does not come up as expected. Fixed in 8.1.4-h2 and later.

From the release note on 8.1.4-h2:

PAN-107271

Fixed an issue on a PA-3200 Series firewall running PAN-OS 8.1.4 in an HA configuration where the HA1-B (backup) port did not come up as expected.

Re: HA Configuration on PA-3220 - HA1 is UP but HA1 Backup is Down

grenzi — Mon, 20 May 2019 13:15:07 GMT

Same issue on PA-3260, PAN-OS 8.1.7... I'm asking to the customer support.

Re: HA Configuration on PA-3220 - HA1 is UP but HA1 Backup is Down

AnalysisMan — Thu, 06 Jun 2019 21:21:33 GMT

Same issue on PA-3220 with PAN-OS 8.1.8.

Re: HA Configuration on PA-3220 - HA1 is UP but HA1 Backup is Down

Verva-Solutions — Mon, 23 Nov 2020 10:48:24 GMT

Looks like this issue came back in 9.1.6...

Re: HA Configuration on PA-3220 - HA1 is UP but HA1 Backup is Down

TomaszLubas — Thu, 26 Nov 2020 07:55:19 GMT

Same here, 3250 ha1 backup down, directly connected.

Re: HA Configuration on PA-3220 - HA1 is UP but HA1 Backup is Down

AnalysisMan — Tue, 25 May 2021 23:26:51 GMT

FYI - Here is a workaround for someone who wants to bring up the HA1 Backup before fixing it by upgrading the PAN-OS (if it's a bug - last time it was).

Step 1. Change the Port type from ha1-b to management on Active firewall and Commit (Device -> High Availability -> General > Control link (HA1 Backup)
Step 2. Revert back to the previous configuration with the Port type: ha1-b, along with the IP address and Commit.

This workaround should bring up the HA1 Backup.
Hope this helps!

* Refer to my blog with screenshots.
https://www.analysisman.com/2018/12/pan-3220-ha1backup.html

Re: HA Configuration on PA-3220 - HA1 is UP but HA1 Backup is Down

TomaszLubas — Thu, 26 Nov 2020 08:47:53 GMT

Thanks for advice, i've noticed it before. It looks like PA is very devoted to management interface, even if there is no port chosen, management is used 🙂

Also this behaviour is observed after migration from older PA. As far as i see there is couple places where imported config has some artefacts comparing to manually made changes.

Tomek

Re: HA Configuration on PA-3220 - HA1 is UP but HA1 Backup is Down

IanBroadway — Thu, 26 Nov 2020 10:03:38 GMT

Issue is in 9.1.5 too, running 3220s also.

Had to swap port back and forth from ha1-b to mgmt as suggested

I assume PA are aware of it?

Re: HA Configuration on PA-3220 - HA1 is UP but HA1 Backup is Down

TomaszLubas — Thu, 26 Nov 2020 12:53:11 GMT

On the 3250 , 9.1.6 also passive PA reboot was required to made ha1-b back as active.

Tomek

Re: HA Configuration on PA-3220 - HA1 is UP but HA1 Backup is Down

JorgeGarcia — Fri, 27 Nov 2020 13:58:06 GMT

Hi,

Same problem on a PA-3250 cluster just after upgrading to 9.1.5. Additional reboot needed just to bring the HA1-b Up again.

Br.

Re: HA Configuration on PA-3220 - HA1 is UP but HA1 Backup is Down

MikeSangray2019 — Fri, 15 Jan 2021 19:47:09 GMT

Same issue on a pair of 3320s. Rebooted the passive firewall, but no change, still red.

Re: HA Configuration on PA-3220 - HA1 is UP but HA1 Backup is Down

MP18 — Sat, 16 Jan 2021 17:25:51 GMT

@aarato

We are running PA 3260 in Active passive PAN OS 9.1.5 and 8.1.9.

No issues so far.

Regards

Re: HA Configuration on PA-3220 - HA1 is UP but HA1 Backup is Down

Bogdanov — Sat, 23 Jan 2021 22:36:37 GMT

For me - it was also necessary to repeat these steps on the passive node

Re: HA Configuration on PA-3220 - HA1 is UP but HA1 Backup is Down

Mindtree_Ltd — Tue, 02 Feb 2021 13:51:20 GMT

Try configuring gateway in ha port configuration, pointing one firewall to other.

Re: HA Configuration on PA-3220 - HA1 is UP but HA1 Backup is Down

StellaP — Tue, 16 Mar 2021 11:39:06 GMT

Same problem with upgrade to 9.1.7

Resolved by changing the ha1-b interface to management and than back again.

Reboot didn't help.

Re: HA Configuration on PA-3220 - HA1 is UP but HA1 Backup is Down

MP18 — Thu, 18 Mar 2021 12:14:11 GMT

@StellaP

I configured pair of PA 3220 in HA and running PAN OS 9.1.5 no issues with HA1 and HA1 backup so far.

Regards

Re: HA Configuration on PA-3220 - HA1 is UP but HA1 Backup is Down

NOC-VL — Wed, 24 Mar 2021 18:47:45 GMT

problem still persists on 9.1.8

reconfigured and it started to work again

didn't try the reboot, this is faster 🙂

Re: HA Configuration on PA-3220 - HA1 is UP but HA1 Backup is Down

MP18 — Thu, 25 Mar 2021 19:28:56 GMT

While upgrading PA 3260 from 8.1.15 to 9.1.5 I saw this issue first time.

Fix was to change HA1-b interface to Management and then back to HA1-b

Regards

Re: HA Configuration on PA-3220 - HA1 is UP but HA1 Backup is Down

Jeff-Flinchum — Sun, 02 May 2021 13:36:58 GMT

For anyone ending up here first like I did - you need to set the gateway in the HA1 config. without it, the interface gets marked down. I just set the gateway to the IP of the HA1 interface of the other side on both sides and it cleared this issue.