HA2 link goes down when enabling HA2 keep-alive - PA VM on Azure

[AhmedAlRashed]

I noticed HA2 link down between the HA A/P peers.

I tried to bounce the link but it didn't help

Disabled session synchronisation and HA2 came up

Re-enabled session synchorisation, HA2 link went down.

Disabled keep-alive on both active and passive firewalls and HA2 link came up

This is when HA2 keepalive is enabled.

This is when HA2 keepalive is disabled.

Has anyone come across this issue before? 

VM-Series Azure

[BPry]

@AhmedAlRashed,

I would advise against HA setups in Azure heavily. It's best to deploy two 'active' firewalls as standalone device and use the 'load balancer sandwich' method to facilitate this. PAN HA sitting in Azure has come a long way since it was initially released, but it simply doesn't scale well and still causes long failover times. I'd avoid an HA config in Azure outright. 

https://www.paloaltonetworks.com/resources/guides/azure-transit-vnet-deployment-guide

[AhmedAlRashed]

@BPry, thanks for your reply! I 100% agree with you but this is just an existing environment that I’ve picked up as I work in a MSSP and this setup was working fine until it broke a couple weeks ago, no changes at all that could’ve caused the issue. I opened a TAC case and waiting on PA team to advise, I have a feeling it’s a bug 🙂

[AhmedAlRashed]

So... I upgraded the firewalls from 10.1.11 to 10.2.8 and re-enabled HA2 keep-alive and HA2 link stays up. It turned out to be a bug as expected.

@BPry FYI