AE Interface State when Connected to Switch LAG

[MikeSangray2019]

I'm working on an HA project, but can't get the interfaces to negotiate.

2 x PA-3220 v8.1     2 x Dell N4032F switches latest recommended firmware

The firewalls are setup for active/passive HA and the switches are configured for MLAG and have a LAG setup to connect to the firewalls. The PA ae interface on the active firewall shows one physical interface as active, but the other is 'not active (negotiation failed)' resulting in an amber link state. I've checked all of the settings on both the PA and switches and it looks like it should be working.

System logs show lacp, critical, nego-fail, "LACP interface ethernet1/19 moved out of AE-group ae1. Selection state Unselected(Negotiation failed)'"

What logs and settings should I check again?

Also wondering if this solution with multiple AE might be an option, but it's an older post so I'm not sure if it still applies.
https://live.paloaltonetworks.com/t5/general-topics/active-pasive-ha-with-lag-to-virtual-chassis-dro...

[BPry · Accepted solution]

@MikeSangray2019,

The LACP configuration on the firewall is pretty basic, and 9/10 we'll find that any issue with LACP negotiation is a configuration issue on the switch side of things if you've already verified mode and transmission rate. The mp-log l2ctrld.log file will have more information related to LACP that may also point you in the right direction, but I would really take a look at the switch configuration first. 

[MikeSangray2019]

It was switch config. Needed to setup a second port channel on the switches so the interfaces that went to firewall 1 were in a port channel and the interfaces that went to firewall 2 were in their own port channel. 

This post also helped.
https://live.paloaltonetworks.com/t5/general-topics/active-pasive-ha-with-lag-to-virtual-chassis-dro...