Issue with PA-445 Failover - Interface Reset

[ControlAdmins]

We just replaced our active-passive PA-850s with PA-445s and have run into an issue when we failover the firewalls.  On failover, all the data-plane interfaces on the new active node go down for 20 seconds before coming back up.  This is dropping every active connection through the firewall.  We did not see this behavior on the PA-850s (failover was basically instantaneous) and we do not see it on PA-1410s we recently deployed either.

Support is claiming this is working as designed and this interface reset behavior was intentionally introduced to the PA-440 series in 11.1.  We did not get a straight answer if the issue is limited to just the PA-440 and PA-445, but we know at least the PA-1410 does not have it.  Anyone else experiencing this? 

[JayGolf]

Hi @ControlAdmins ,

There was a known issue (PAN-181968) that affected the PA-4xx series where interfaces could take longer than expected to come up during HA failover. That behavior wasn’t intentional and it’s been corrected in later releases so you should already have the fix in 11.1.

With that resolved, the most common factor I’ve seen influence longer failover times on the PA-400 series is the Passive Link State setting. What do you currently have that configured as? If it’s set to shutdown, the passive unit keeps its interfaces physically down. Switching Passive Link State to Auto keeps the ports up on the passive firewall, which prevents link renegotiation during failover and improves failover times. 

[ControlAdmins]

We have passive link state set to auto in the "Active/Passive Settings" in the HA config.  We are also on 11.1.10-h1.  If it is in a newer release than that, we haven't taken it yet, as we usually only take preferred releases and haven't made the jump to 11.2 yet.

[jasonroy]

Older post, but our PA-445 Ha pair do not experience this. Presently on 11.1.10-h12, but we also used 11.1.10-h10. We did not use 11.1.10-h1 as we came directly from 11.1.6-h17.

In addition to having the physical ports having "Enable in HA Passive State" enabled, check to see if the switch is registering any type of change during HA failover. We do have our ports configured for "spanning-tree admin-edge-port" (HPE Aruba's version of Cisco portfast), but that should have no impact as the passive PAN's ports should already be enabled/up and in an STP forwarding state before, during, and after failover and should never "bounce" and not cause a STP topology change or event.

Presently we only have a pair of PA-445s in Test and one remote lower-speed field location. When doing a failover we do not experience any STP changes on the switches connected to the PA-445s' interfaces. Pinging through the PA-445 to a switch that is used for management access we drop 1-3 pings, but usually just 1 ping, and this is likely due to the IPSEC tunnel switching over between PANs and not the traffic itself. I don't have a way to test non-tunneled traffic on PA-445 at this time. However, none of our OT devices report any problems with two SCADA systems that are connected or even notice we're doing the HA failover at the remote site.