AE Interface State when Connected to Switch LAG

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

AE Interface State when Connected to Switch LAG

L3 Networker

I'm working on an HA project, but can't get the interfaces to negotiate.

2 x PA-3220 v8.1     2 x Dell N4032F switches latest recommended firmware

 

The firewalls are setup for active/passive HA and the switches are configured for MLAG and have a LAG setup to connect to the firewalls. The PA ae interface on the active firewall shows one physical interface as active, but the other is 'not active (negotiation failed)' resulting in an amber link state. I've checked all of the settings on both the PA and switches and it looks like it should be working.

System logs show lacp, critical, nego-fail, "LACP interface ethernet1/19 moved out of AE-group ae1. Selection state Unselected(Negotiation failed)'"

What logs and settings should I check again?

Also wondering if this solution with multiple AE might be an option, but it's an older post so I'm not sure if it still applies.
https://live.paloaltonetworks.com/t5/general-topics/active-pasive-ha-with-lag-to-virtual-chassis-dro...

1 accepted solution

Accepted Solutions

Cyber Elite
Cyber Elite

@MikeSangray2019,

The LACP configuration on the firewall is pretty basic, and 9/10 we'll find that any issue with LACP negotiation is a configuration issue on the switch side of things if you've already verified mode and transmission rate. The mp-log l2ctrld.log file will have more information related to LACP that may also point you in the right direction, but I would really take a look at the switch configuration first. 

View solution in original post

2 REPLIES 2

Cyber Elite
Cyber Elite

@MikeSangray2019,

The LACP configuration on the firewall is pretty basic, and 9/10 we'll find that any issue with LACP negotiation is a configuration issue on the switch side of things if you've already verified mode and transmission rate. The mp-log l2ctrld.log file will have more information related to LACP that may also point you in the right direction, but I would really take a look at the switch configuration first. 

It was switch config. Needed to setup a second port channel on the switches so the interfaces that went to firewall 1 were in a port channel and the interfaces that went to firewall 2 were in their own port channel. 

This post also helped.
https://live.paloaltonetworks.com/t5/general-topics/active-pasive-ha-with-lag-to-virtual-chassis-dro...

 

  • 1 accepted solution
  • 4737 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!