AE Interface State when Connected to Switch LAG

Reply
Highlighted
L2 Linker

AE Interface State when Connected to Switch LAG

I'm working on an HA project, but can't get the interfaces to negotiate.

2 x PA-3220 v8.1     2 x Dell N4032F switches latest recommended firmware

 

The firewalls are setup for active/passive HA and the switches are configured for MLAG and have a LAG setup to connect to the firewalls. The PA ae interface on the active firewall shows one physical interface as active, but the other is 'not active (negotiation failed)' resulting in an amber link state. I've checked all of the settings on both the PA and switches and it looks like it should be working.

System logs show lacp, critical, nego-fail, "LACP interface ethernet1/19 moved out of AE-group ae1. Selection state Unselected(Negotiation failed)'"

What logs and settings should I check again?

Also wondering if this solution with multiple AE might be an option, but it's an older post so I'm not sure if it still applies.
https://live.paloaltonetworks.com/t5/general-topics/active-pasive-ha-with-lag-to-virtual-chassis-dro...


Accepted Solutions
Highlighted
Cyber Elite

Re: AE Interface State when Connected to Switch LAG

@MikeSangray2019,

The LACP configuration on the firewall is pretty basic, and 9/10 we'll find that any issue with LACP negotiation is a configuration issue on the switch side of things if you've already verified mode and transmission rate. The mp-log l2ctrld.log file will have more information related to LACP that may also point you in the right direction, but I would really take a look at the switch configuration first. 

View solution in original post


All Replies
Highlighted
Cyber Elite

Re: AE Interface State when Connected to Switch LAG

@MikeSangray2019,

The LACP configuration on the firewall is pretty basic, and 9/10 we'll find that any issue with LACP negotiation is a configuration issue on the switch side of things if you've already verified mode and transmission rate. The mp-log l2ctrld.log file will have more information related to LACP that may also point you in the right direction, but I would really take a look at the switch configuration first. 

View solution in original post

Highlighted
L2 Linker

Re: AE Interface State when Connected to Switch LAG

It was switch config. Needed to setup a second port channel on the switches so the interfaces that went to firewall 1 were in a port channel and the interfaces that went to firewall 2 were in their own port channel. 

This post also helped.
https://live.paloaltonetworks.com/t5/general-topics/active-pasive-ha-with-lag-to-virtual-chassis-dro...

 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!