failover

[jdprovine]

Is there anything such as a particle failover with a palo alto firewall? Can it start to failover and suddenly fail back and block some traffic

[BPry]

@jdprovine,

One would not expect so. When you say sync are you talking about the config sync? 

[jdprovine]

@BPry

Yes the config sync seems stuck

[BPry]

If you do a config audit between the active and passive firewall is anything actually different? Honestly it sounds like your Passive firewall got a little hosed; has it been restarted since the split-brain toke place? 

[jdprovine]

@BPry

I pushed a sync from the primary and it fixed it

[jdprovine]

@BPry

Yes we went ahead and restarted our secondary and that fixed the issue but I still don't know why it was going a route that no longer existed any ideas where to look? 

[BPry]

@jdprovine,

Initial guess would be that you should check the config audit and see if for some reason it didn't somehow jump back to an old config from when that was a valid route. Other than that I can't really think of why it would be using that IP if it was removed several months ago. 

[TranceforLife]

@jdprovine,

PA will send traffic based on its own routing table or VRs. Was it static route pointing to that router IP or dynamically learned one? 

[jdprovine]

@TranceforLife

I would be able to search for it with the global search wouldn't I. The other issue is that this wasn't a problem until we last power, the heart beat connection failed and we went into a split brain condition. We did check before restarting the secondary, that the primary was listed as active and the secondary was list as passive. I checked the traffic monitor, system logs and did verify that it was only passing traffic on the secondary during the loss of heartbeat connection and then it was only passing on the primary. It was also only one of our zones not all. Very curious situation.