HA Configuration on PA-3220 - HA1 is UP but HA1 Backup is Down

[aarato]

I have both PA-3220 HA1-A and HA1-B links connected back to back to each other with a previously verified cable but only HA1 is coming up greeen while HA1 Backup is showing down. The HA1-B interface LEDs on both PA-3220 show green.

Any feedback or suggestion is greatly appreciated.

PassiveHA Setup BHA Setup AActive

[TomaszLubas]

Same here, 3250 ha1 backup down, directly connected.

[AnalysisMan]

FYI - Here is a workaround for someone who wants to bring up the HA1 Backup before fixing it by upgrading the PAN-OS (if it's a bug - last time it was).

Step 1. Change the Port type from ha1-b to management on Active firewall and Commit (Device -> High Availability -> General > Control link (HA1 Backup)
Step 2. Revert back to the previous configuration with the Port type: ha1-b, along with the IP address and Commit.

This workaround should bring up the HA1 Backup.
Hope this helps!

* Refer to my blog with screenshots.
https://www.analysisman.com/2018/12/pan-3220-ha1backup.html

[TomaszLubas]

Thanks for advice, i've noticed it before. It looks like PA is very devoted to management interface, even if there is no port chosen, management is used 🙂

Also this behaviour is observed after migration from older PA. As far as i see there is couple places where imported config has some artefacts comparing to manually made changes.

Tomek

[IanBroadway]

Issue is in 9.1.5 too, running 3220s also.

Had to swap port back and forth from ha1-b to mgmt as suggested

I assume PA are aware of it?

[TomaszLubas]

On the 3250 , 9.1.6 also passive PA reboot was required to made ha1-b back as active.

Tomek