Normal behavior of LACP in passive/active HA setup.

[jlpanes24]

Hi,

I would just like to verify the normal behavior of LACP in an Active/Passive HA setting.

Currently we have a pair of PA-3060 running 6.1.10 in active/passive. Both devices have LACP bundles towards a Cisco router.

On the active firewall the LACP negotiates properly but on the passive firewall the interfaces shows up but doesnt negotiate the LACP session. Also on the Cisco router the portchannel towards the passive firewall goes into a suspended state since it detects that LACP is not enabled on the remote port.

Is this the normal behavior? or is the prenegotiation of LACP for the passive firewall avaiable on this version or newer ones?

We are usually getting syslog messages from our Cisco router that the interfaces are down, and we need to check whether if its actually down or just connected to the passive firewall. We would like to minimize this false positives.

regards,

Jon 

[jvalentine]

This was added in PAN-OS 7.1 and should work with the PA-3000 series.  See the following documentation link from the PAN-OS 7.1 "new features guide":

 - https://www.paloaltonetworks.com/documentation/71/pan-os/newfeaturesguide/networking-features/lacp-a...

In releases before 7.1, it is expected that the passive firewall will not have an active LACP session and won't attempt to negotiate LACP until after it becomes the active firewall.  

[fjwcash]

It also depends on whether you have the fast fall-over enabled on the firewall. Forget the name for the option. With it disabled, the secondary firewall will not have active links until it becomes the primary, which could be a few seconds. With it enabled, the secondary firewall will have active links, but will not accept any ongoing traffic. When it becomes the primary, The active links start accepting traffic within milliseconds.

[jlpanes24]

Hi,

When you said active links, is it the physical links or the aggregated interface?

regards,

Jon