arp issue with PA Active/Active

[Alex_Samad]

Hi

2 PA-3060's, setup in Active / active

I have a vlan 213 with 10.172.213.0/24 assigned to it

I have .2 and .3 assigned to the PA's and .1 assigned as a HA Virtual ip .

I also have 3 virtual machines, app1 app2 app3.

app1 and app3 can arp 10.172.213.1, app2 can't 

these vm's are on the same host, and a few hours ago app2 could arp .1 (DGW).

last time I fixed it by rebooting both PA.

also I have tried (and it worked), but shutting down the Active state of each PA one by one and letting things fail over .. so shutdown pa1 wait then turn on pa1 and turn off pa2 and wait and then turn on pa2.

How can I diagnose this problem ??

What am I missing ?

[BPry]

This is a pretty common issue in an Active/Active configuration and there are a lot of potential problems that you could be hitting; this type of thing is why Active/Active configuration is really not advised unless you are doing a large amount of async routing. 

[Alex_Samad]

Hi

Okay, I can accept Active/Active is complicated.  What I can't accept it that it just broken. if it work for big environments then it should work for all environments.

Because this is a trial, I want to investigate what the issue is.

I have done packet captures on both pa's and I can see the arp request is being dropped by both PA's ???  thats very strange

If this is a common issue, then maybe the PA's are not for me. this seems like a fairly standard easy setup. My Aristra switches can do vrrp across 2 nodes for a distributed DGW.

 When I disable one pa1 from the active active setup it all works fine..

[Alex_Samad · Accepted solution]

Its an interaction between OSPF and active active.

The primary PA inserts a /32 into the routing table so it is the only device that responds to pings but OSPF takes that and redistributes it to the other PA, once that OSPF route is in the table it stops responding to arp’s !!!!

Solution I have to filter out all the VIP address from  OSPF

Interesting ....