HA1 Backup link went down root cause analysis

Announcements

ATTENTION Customers, All Partners and Employees: The Customer Support Portal (CSP) will be undergoing maintenance and unavailable on Saturday, November 7, 2020, from 11 am to 11 pm PST. Please read our blog for more information.

Reply
Highlighted

HI @reaper,

 

Yes , You are correct commit has been done @ 11:53AM on 29th but this related to address object configuration mapping to address group and then calling in source addres of policy.

 

i'm more curious how this affect HA port configured somewhere in my firewall. 

 

Regards

Venky 

Highlighted

HI @reaper

 

Awaiting for your reply.

Highlighted

HI @reaper

 

I have seen one more interesting thing, The HA-B port was dropping packets. which happened in primary firewall.

 

So my issue is in active firewall which dropped the packets so HA1-B went down.  SInce I have the tech support file generated after clearing the issue. I'm not able to see the memory during time of issue. 

 

Interface: ha1-b

-------------------------------------------------------------------------------
Logical interface counters:
-------------------------------------------------------------------------------
bytes received 207647488
bytes transmitted 214917298
packets received 4254056
packets transmitted 4261401
receive errors 0
transmit errors 0
receive packets dropped 10769
transmit packets dropped 0
multicast packets received 0
-----------------------------------------

 

 

Highlighted
L7 Applicator

Don't focus too much on these numbers until you can directly correlate them to the actual event. some packets may get dropped naturally, or they could have been from a previous issue (possibly during initial config)

 

since the connection was impacted during the commit you'll need to look at both techsupport files side by side starting secondas before the commit starts, see if there are unusual; spikes in MP or DP cpu, those drop counters should be correlated for their delta during the commit (does the number increase gradually over time, or does it spike during the commit)

 

the content of the commit may not necessarily be related to the interface itself, it's possible something during the commit chokes the interfaces for some reason

 

do you have as support case open already? If not,m this may be a good time to do so

Tom Piens - PANgurus.com
New to PAN-OS or getting ready to take the PCNSE? check out amazon.com/dp/1789956374
Highlighted

HI @reaper

 

I have case opened with TAC and they are researching on root casuse. I will keep you posted once I get update.

 

Thank you so much for all your analysis for betterment in investigation.

 

Regards

Venky

Highlighted
L3 Networker

Any updates on this case? I've got the same issue on PA-3220 with PAN-OS 8.1.8.

I see the symptom precisely like you that 'receive packets dropped' increased on Active firewall. I'm going to open a case with TAC.

 

 

--
"The Simplicity is the ultimate sophistication." - Leonardo da Vinci.
Highlighted

Hi

this is a known bug gonna fixed in 8.1.9 or 9.0 version . You can wait for 8.1.9 or can upgrade to 9.0

Highlighted
L3 Networker

Thanks for your reply!

Do you have the bug/issue ID? Or is this non-public one?

 

--
"The Simplicity is the ultimate sophistication." - Leonardo da Vinci.
Highlighted
L3 Networker

FYI - 

Here is a workaround for someone who wants to bring up the HA1 Backup before upgrading the PAN-OS.

 

Step 1. Change the Port type from ha1-b to management on Active firewall and Commit (Device -> High Availability -> General > Control link (HA1 Backup)
Step 2. Revert back to the previous configuration with the Port type: ha1-b, along with the IP address and Commit.

 

This workaround should bring up the HA1 Backup.

Hope this helps!

 

--
"The Simplicity is the ultimate sophistication." - Leonardo da Vinci.
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!