HA not working with interface monitoring any

[NetworkGeek]

Hello all,

i configured HA between paloalto peers , and HA failover as default without definig specifc interfaces and left it to "any"

when interface of inside zone shutdown from switch side , failover will not be trigered ? and need to fix it

[TranceforLife · Accepted solution]

Hi,

Did you create a Link Group and assign interfaces there? Looks to me that failover  conditions were not met:

https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/framemaker/70/pan-os/pan-os/sectio...

[TranceforLife · Accepted solution]

Heartbeat Polling and Hello messages:

The firewalls use hello message and heartbeats to verify that the peer firewall is responsive and operational. Hello messages are sent from one peer to the other at the configured Hello Interval to verify the state of the firewall. The heartbeat is an ICMP ping to the HA peer over the control link, and the peer responds to the ping to establish that the firewalls are connected and responsive. By default, the interval for the heartbeat is 1000 milliseconds. A ping is sent every 1000 milliseconds and if there are three consecutive heartbeat losses, a failovers occurs. For details on the HA timers that trigger a failover, see HA Timers.

As we can see it is one of the conditions, so it will trigger failover (if you do not have a backup link configured). If both HA Control link and backup links fails failover occurs:

But l am not sure what will happen if HA Datalink fails. Let see for others replies 

[TranceforLife · Accepted solution]

Hi,

Did you create a Link Group and assign interfaces there? Looks to me that failover  conditions were not met:

https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/framemaker/70/pan-os/pan-os/sectio...

[NetworkGeek]

Ok working now , but what is meant by failure condition (ANY)  at link monitoring ?

[NetworkGeek]

Ok i undersatnd now ..

Any means any "Group" and inside each group there is other ANY which means any interface inside group

But new question , failure of HA links didn`t trigger failover ??

[TranceforLife · Accepted solution]

Heartbeat Polling and Hello messages:

The firewalls use hello message and heartbeats to verify that the peer firewall is responsive and operational. Hello messages are sent from one peer to the other at the configured Hello Interval to verify the state of the firewall. The heartbeat is an ICMP ping to the HA peer over the control link, and the peer responds to the ping to establish that the firewalls are connected and responsive. By default, the interval for the heartbeat is 1000 milliseconds. A ping is sent every 1000 milliseconds and if there are three consecutive heartbeat losses, a failovers occurs. For details on the HA timers that trigger a failover, see HA Timers.

As we can see it is one of the conditions, so it will trigger failover (if you do not have a backup link configured). If both HA Control link and backup links fails failover occurs:

But l am not sure what will happen if HA Datalink fails. Let see for others replies 

[NetworkGeek]

Thank You

[Mehul_Pathak]

In the virtual deployment I do not have access to any upstream device to trigger the link failure scenario - how do I test if the link monitoring configuration is working or not? Can I turn the Firewall interface into 'shut' mode to trigger the failover?