HA ACTIVE firewall is failing when commit

[F.Pinar]

The problem is that after performing a Commit&Push, the primary (active) firewall generates a status change that affects the signaling of the Cisco Nexus switch ports, causing them to enter suspended mode on both switches in the VPC configuration. After the switch stops seeing the primary firewall, the primary firewall does not switch. Disconnecting the ports on the primary (active) switch and reconnecting them does not remedy the situation. When the primary firewall is turned off, it switches and communication is restored through the secondary firewall's port-channel. When the primary firewall, now passive, is turned on, communication with the port-channel is restored.

Translated with DeepL.com (free version)

Pa-3400 version 11.1.4-h7

[F.Pinar]

Troubleshooting : 

HA_AGENT.LOG
2026/02/10 06:38:28 2026-02-10 06:38:28.065 -0800 Error:  hc_members_hostname_get_cb(src/ha_cluster.c:512): DSSD host node currently not available
2026/02/10 06:39:12 2026-02-10 06:39:12.162 -0800 Error:  ha_state_stop_increase_monitor_holdup(src/ha_state.c:1252): Got into monitor holdup increase stop without start

I got that there is a bug reported for HA/DSSD/COMMIT, however, there is no public bug. Moreover, today I got this in which there was a previous issue reported PAN-215315

https://live.paloaltonetworks.com/t5/asc-discussion-forum/both-side-ha-2-failed/td-p/557184

By any chance that you have a workaround or whether it is necessary to upgrade the version to a preferred release to solve it. In addition, the issue started as soon as they upgraded it to 11.1.4-h7

Any kind of recommendation would be highly cherished.

Best Regards,

Bug in HA state machine in 11.1.4-h7 under commit events with AE + vPC

[Raido_Rattameister]

If you have ongoing issue, why you intentionally run anything below preferred release?

As step 1 upgrade to preferred release and if issue still occurs then open TAC case to get eta for bug fix.