HA Failover Issue on PA-3420 with AE LACP – Both Nodes Active (Split Brain ?)

[romen54]

We’re experiencing a critical issue with our HA setup on a pair of Palo Alto PA‑3420 firewalls running PAN‑OS 11.1.6‑h3 in Active‑Passive mode (HA Group 25, preemptive disabled). Both firewalls simultaneously believed they were active, causing a complete traffic halt and requiring a manual reboot of the actual active node to restore service. We suspect the problem is tied to our LACP configuration on AE-group ae1 (aggregating Ethernet1/13–16 with LACP in fast mode). Logs indicate that interfaces were being moved out of the AE-group due to link down events, and there were HA sync issues (Can't synchronize control plane data). We’ve verified cabling, switch configuration, and LACP status (ports show collecting/distributing when stable). Our HA settings and IPs are correctly matched, and we’re using a PSK for HA communication. We’re looking for guidance on how to stabilize LACP and prevent AE-group flapping from affecting HA, whether there are known bugs in PAN-OS 11.1.6-h3 related to HA or LACP, and any best practices to ensure HA state remains consistent during link transitions. Any insights or suggestions would be greatly appreciated.

[SutareMayur]

Hi @romen54 Did you checked this article? This will help to check all the causes and resolutions of Split-Brain situation. 

[BPry]

@romen54,

Did this start out of the blue or after you applied 11.1.6-h3? I've had multiple instances where recent PAN-OS releases have caused a split-brain scenario and reverting has immediately resolved the issue across multiple different models in active/passive setups.

As for the LACP issue causing a split-brain scenario, I think your LACP issues are more than likely a consequence of your split-brain scenario than the issue causing your split-brain scenario. Do you have HA1/HA2 directly connected between the two units or are you passing it through a switch? If you're passing it through a switch, is it the same one handling your aggregates?