Intermittitent Communication Problem

[xcz504d1114]

I was wondering if anyone else has seen this issue or knows of the possible cause. The issue is, some traffic is not being passed through the paloalto in a vwire Active / Active configuration.

For instance, 2 people on the same subnet, connected to the same switch, person A can ping the device through the PAN firewall, but Person B cannot. This is true from several locations, from Core A, it is not reachable, from Core B it is etc. I don't see any denied traffic (or permitted traffic) from the source that is not able to communicate, by passing the PAN FW resolves the issue, or swapping the physical connection to the other PAN FW also resolves the issue.

I am running 4.0.8 OS.

Thanks,

Craig

[spolo]

When running Active-Active there are a lot more variables in the equation, consequently more difficult to troubleshoot.  Since traffic is active on both devices, you'll have to look at logs on both devices so understand traffic flow.  If you have to do packet captures, you'll also have to look at both devices, which ultimately you may have to do here if you can't track it down.

Generally, I have not seen what you're describing with Active-Active vWire.  I've mostly seen it work pretty well, but there could be other things in your network that could be creating a problem, as your network design with vWire needs to be a consideration.  For example, if there are two vWires between two switches, spanning tree running on your switches could be blocking one of the vWire paths, creating an issue.

While there may be circumstances that require Active-Active, I generally prefer Active-Standby for simplicity of troubleshooting, but if you must use Active-Active, know that your troubleshooting burden will be larger and I'd get some help from your reseller engineer, local Palo Alto Networks SE or Palo Alto Networks support team.