PA-820 & LACP

Reply
L2 Linker

PA-820 & LACP

Hi

Just wondering if anyone here has successfully gotten LACP to work on a PA-800 series FW (set to passive) and Cisco Switch (set as 'channel-group X mode active')?

No matter what I try (fast/slow/active/passive/1 eth/2 eth) I always get "LACP currently not enabled on the remote port" in the Cisco console output.

I saw this twice this week at two different deplyments - don't know what switch is used on the second deployment, but LACP fails to work regardless).

 

Is there a special configuration on the Cisco side that we might have missed? Maybe due to PA-800 not supporting pre-negotiation?

 

Many thanks,

Shai

Tags (3)
L4 Transporter

Re: PA-820 & LACP

Howdy

 

I do not think it is a misconfiguration on either product. I think it understanding how the PANW firewall does passive firewall interfaces.

 

By default, in HA on the PANW firewalls, the EXACT configuration (minus HA and Admin accounts) is synch'd across both FWs.

Because both Active and Passive FW have the EXACT inside IP/mask, there needed to be a way to ensure the passive fw did NOT try to respond to arp requests, when it was in passive mode.

 

This is accomplished (and I think this the issue), by ensuring that the passive fw interfaces are administratively DOWN.

This seems to be the reason why you would not get LACP adjancency.

 

If you change the setting to up, it may assist in adjacency for LACP.

 

2019-09-12 12_56_06-.png

L4 Transporter

Re: PA-820 & LACP

@ShaiW There is an option to configure passive HA firewall interfaces in state "Auto" and enable LACP, however this is only supported on the 3 and 5 series and not on the 820. See article below

 

https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/high-availability/ha-concepts/lacp-and-lld...

 

As @SteveCantwell your only option is to configure passive interfaces to "shutdown", so at least you will not get LACP errorrs. 

 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!