Issues with connectivity between HA PAs and Nexus Leaf Switches

[rmeskill]

I've inherited a setup which has PAs with two vsys each connecting:
external switch/router > PA external vsys > A10 Load Balancers > PA internal vsys > Cisco Nexus Leaf switches

We run a full mesh setup (1x interface from each side of the PA HA pair to each (upstream switch, external A10, internal A10) internal device, both primary and secondary side. Then on the inside from the Nexus leaf switches to the PA we run ae1 with 2 interfaces to each (pair) of leafs (1 & 2, 3 & 4).

I've been troubleshooting slow failover (2-5 minutes) between PAs but in trying to turn up HA Passive Link State: Auto (locally committed on my PAs) it took down the whole site. And I'm thinking there's some sort of configuration issue with the leaf connections to the PAs. To clarify:

On the leafs there are 2x unique VPCs (1 & 2, 3 & 4) and each pair of PA connections is on a port-channel for each of those VPC pairs (they're the same number, but physically/logically separate). Can anyone think of any reason this wouldn't work as is? 

[BPry]

@rmeskill,

Did you review the logs on the Nexus and PAN side of things to see what they were doing during the outage? When you set the passive link state to Auto, did you also go into your AE interfaces and toggle the 'Enable in HA Passive State' under LACP?

[rmeskill]

Yes, the interfaces come up on the passive FW leaf switch interfaces:
2026 Oct 2 10:09:38 passiveleaf %ETHPORT-5-SPEED: Interface Ethernet1/19, operational speed changed to 10 Gbps
2026 Oct 2 10:09:38 passiveleaf %ETHPORT-5-IF_DUPLEX: Interface Ethernet1/19, operational duplex mode changed to Full
2026 Oct 2 10:09:38 passiveleaf %ETHPORT-5-IF_RX_FLOW_CONTROL: Interface Ethernet1/19, operational Receive Flow Control state changed to off
2026 Oct 2 10:09:38 passiveleaf %ETHPORT-5-IF_TX_FLOW_CONTROL: Interface Ethernet1/19, operational Transmit Flow Control state changed to off
2026 Oct 2 10:09:38 passiveleaf %ETHPORT-5-SPEED: Interface port-channel20, operational speed changed to 10 Gbps
2026 Oct 2 10:09:38 passiveleaf %ETHPORT-5-IF_DUPLEX: Interface port-channel20, operational duplex mode changed to Full
2026 Oct 2 10:09:38 passiveleaf %ETHPORT-5-IF_RX_FLOW_CONTROL: Interface port-channel20, operational Receive Flow Control state changed to off
2026 Oct 2 10:09:38 passiveleaf %ETHPORT-5-IF_TX_FLOW_CONTROL: Interface port-channel20, operational Transmit Flow Control state changed to off
2026 Oct 2 10:09:39 passiveleaf %ETHPORT-5-SPEED: Interface Ethernet1/35, operational speed changed to 10 Gbps
2026 Oct 2 10:09:39 passiveleaf %ETHPORT-5-IF_DUPLEX: Interface Ethernet1/35, operational duplex mode changed to Full
2026 Oct 2 10:09:39 passiveleaf %ETHPORT-5-IF_RX_FLOW_CONTROL: Interface Ethernet1/35, operational Receive Flow Control state changed to off
2026 Oct 2 10:09:39 passiveleaf %ETHPORT-5-IF_TX_FLOW_CONTROL: Interface Ethernet1/35, operational Transmit Flow Control state changed to off
2026 Oct 2 10:09:39 passiveleaf %ETHPORT-5-IF_UP: Interface Ethernet1/35 is up in mode trunk
2026 Oct 2 10:09:42 passiveleaf %ETH_PORT_CHANNEL-5-PORT_UP: port-channel20: Ethernet1/19 is up
2026 Oct 2 10:09:42 passiveleaf %ETH_PORT_CHANNEL-5-FOP_CHANGED: port-channel20: first operational port changed from none to Ethernet1/19
2026 Oct 2 10:09:42 passiveleaf %ETHPORT-5-IF_BANDWIDTH_CHANGE: Interface port-channel20,bandwidth changed to 10000000 Kbit
2026 Oct 2 10:09:42 passiveleaf %ETHPORT-5-IF_UP: Interface Ethernet1/19 is up in mode trunk
2026 Oct 2 10:09:42 passiveleaf %ETHPORT-5-IF_UP: Interface port-channel20 is up in mode trunk
2026 Oct 2 10:11:31 passiveleaf %ETHPORT-5-IF_DOWN_LINK_FAILURE: Interface Ethernet1/35 is down (Link failure)
2026 Oct 2 10:11:31 passiveleaf %ETH_PORT_CHANNEL-5-FOP_CHANGED: port-channel20: first operational port changed from Ethernet1/19 to none
2026 Oct 2 10:11:31 passiveleaf %ETH_PORT_CHANNEL-5-PORT_DOWN: port-channel20: Ethernet1/19 is down
2026 Oct 2 10:11:31 passiveleaf %ETHPORT-5-IF_DOWN_PORT_CHANNEL_MEMBERS_DOWN: Interface port-channel20 is down (No operational members)
2026 Oct 2 10:11:31 passiveleaf %ETHPORT-5-IF_BANDWIDTH_CHANGE: Interface port-channel20,bandwidth changed to 100000 Kbit
2026 Oct 2 10:11:31 passiveleaf %ETHPORT-5-IF_DOWN_LINK_FAILURE: Interface Ethernet1/19 is down (Link failure)
2026 Oct 2 10:11:31 passiveleaf %ETHPORT-5-IF_DOWN_PORT_CHANNEL_MEMBERS_DOWN: Interface port-channel20 is down (No operational members)
I've confirmed routing looks fine on the primary PA, so I just think the leafs themselves are allowing these interfaces into the port-channel and they're locking them out. I should note leaf1/2 are port-channel21 and leaf3/4 are port-channel20, so they should be separated, but is that an issue?