Active-Passive pair takes long to show the status when one is rebooted.

[nson2139]

Folks,

Our Active-Passive pair takes too long to show the status(i.e. active or passive) when one of the firewall is rebooted.

i.e. as of now things are running fine, but if I reboot the passive firewall it will take a very long time to once again come up as passive. It goes through the "not ready" and "initial" stages before getting in the "passive" stage.

These are PA-3260 boxes and I have used the ha1-a as the control link and the ha1-b port as the backup for control link. Only the control link has been used for this HA configuration.

Please let me know if there are any suggestions on this and how could I work on overcoming the long time duration?

 Thanks!!!

[ShaiW]

Hi

I would try using management as backup for HA1 instead of ha1-b. I know there is an issue with HA1-backup port that in my case shows as down when using ha1-b and up when using management. Maybe the issue is deeper and affects other HA-processes.

Also I would check the Management-Plane logs (ssh into the machine and use: 'less mp-log [tab-key]') for the time after the restart (ha-agent.log as a start).

Hope this helps.

[Remo]

---

@nson2139 wrote:

It goes through the "not ready" and "initial" stages before getting in the "passive" stage.

---

This is normal after reboot of a device in HA-configuration.

---

@nson2139 wrote:

but if I reboot the passive firewall it will take a very long time to once again come up as passive.

---

What do you mean with very long exactly?

---

@nson2139 wrote:

Only the control link has been used for this HA configuration.

---

Why don't you use the data link also? I think by default the firewall tries to sync the session table over HA2 link, but as ther is none of them in your configuration this could be a reason why it could take (a little) longer than normal. Do you have disabled session sync (even if I don't know the exact behaviour of this option without a HA2 link)

[nson2139]

by very long I mean more than 4 hours.... I am not sure if that is normal.

to configure the data link I do not have the hardware and this is not a requirement at this moment.

[ShaiW]

4 hours is way to long. Does this only happen on 1 of the FW nodes or if you switch the active FW will the other node also take 4 hours?

[nson2139]

upgrading to 8.1.4 reduced the state changing time but it still takes around 1 hr.

[nson2139]

upgrading to 8.1.4 reduced the state changing time but it still takes around 1 hr.

[Remo · Accepted solution]

Did you disable the checkbox for session synchronization? Maybe worth a try...

[nson2139]

It gave me a warning saying "High-availability with ha2 configured should also be configured with state synchronization enabled(Module: ha_agent)" but immediately came up in the passive state." 🙂

This looks good, should the warning cause any challenges? 

[Remo]

I would say it isn't recommended to have a HA setup without HA2 link. But because you don't want to have an HA2 link anyway (and you never had) this warning does not matter. (Without HA2 link the firewall isn't able to sync sessions anyway)