topic PA850 HA Switchover Delay in General Topics

PA850 HA Switchover Delay

aataro — Mon, 26 Apr 2021 09:59:45 GMT

I have setup two PA850 in a active passive pair. I am simulating failover manually, when I disconnect the cable, I see around 8 packet drops. Is there any specific settings to reduce the delay. 4 packet drops are acceptable. I have bundled interfaces on the firewall.

Re: PA850 HA Switchover Delay

nikoolayy1 — Mon, 26 Apr 2021 10:05:51 GMT

Try first with the aggresive failover profile and if needed play with the advanced settings (Monitor Fail Hold Up Time (ms)):

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/high-availability/ha-concepts/ha-timers.html

Also if you want better failover because or routing path monitoring see BFD:

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/networking/bfd/configure-bfd.html

Re: PA850 HA Switchover Delay

reaper — Tue, 27 Apr 2021 13:04:29 GMT

you can optimize your failure detection by setting more aggressive timers in device > high availability > general > election settings and setting the HA Timer Settings to 'aggressive'

If you did not do so, configure your aggregate interfaces for LACP and also enable LACP in HA passive state (you'll need to change the passive link state to 'auto' in device > high availability)