what can be the reason for and ( description contains 'HA Group 1: Peer HA2-Backup keep-alive down'

Reply
L4 Transporter

what can be the reason for and ( description contains 'HA Group 1: Peer HA2-Backup keep-alive down'

We have PA5220 HA2 backup connection on copper port running via switch.

today we got alerts on both active and passive firewalls.

 

and ( description contains 'HA Group 1: Peer HA2-Backup keep-alive down' )

 

and ( description contains 'HA Group 1: Local HA2-Backup keep-alive down' )

 

i check the physical interface no errors.

how can i know reason for this flap?

Community Manager

Re: what can be the reason for and ( description contains 'HA Group 1: Peer HA2-Backup keep-alive d

In short, they were each unable to ping the remote end. Did anything occur on the switch?was a port reconfigured, flapped, shut, disconnected,...? Are the firewalls connected to the same chassis or is there another link to consider?

Are the other HA links connected directly or via different switches?


Help the community: Like helpful comments and mark solutions
Reaper out
L4 Transporter

Re: what can be the reason for and ( description contains 'HA Group 1: Peer HA2-Backup keep-alive d

HA2 link is directly connected between firewalls.No switch involved.

 

HA2 connection goes via switch.

Verify switch is fine and no issues with switch port.

No errors on the switch port.

Nothing happened on the switch port,no config ,no flap etc.

 

Any logs i can check on PA  side?

L7 Applicator

Re: what can be the reason for and ( description contains 'HA Group 1: Peer HA2-Backup keep-alive d

@MP18,

The system logs will just point you towards what @reaper already stated, the firewalls missed an ICMP response. If you aren't seeing anything on the switch at all as far as the port is concerned, I would look at the load and make sure the ICMP request wasn't dropped due to load. 

L4 Transporter

Re: what can be the reason for and ( description contains 'HA Group 1: Peer HA2-Backup keep-alive d

Hi BPry,

 

Thanks for replying.

For load I can use show running resource monitor?

Any specific cli command to check the load?

 

Also which logs i can see which shows firewall do the icmp ping to the passive firewall?

 

Regards

Mike

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!