PA-820 & LACP

[ShaiW]

Hi

Just wondering if anyone here has successfully gotten LACP to work on a PA-800 series FW (set to passive) and Cisco Switch (set as 'channel-group X mode active')?

No matter what I try (fast/slow/active/passive/1 eth/2 eth) I always get "LACP currently not enabled on the remote port" in the Cisco console output.

I saw this twice this week at two different deplyments - don't know what switch is used on the second deployment, but LACP fails to work regardless).

Is there a special configuration on the Cisco side that we might have missed? Maybe due to PA-800 not supporting pre-negotiation?

Many thanks,

Shai

[SCantwell_IM · Accepted solution]

Howdy

I do not think it is a misconfiguration on either product. I think it understanding how the PANW firewall does passive firewall interfaces.

By default, in HA on the PANW firewalls, the EXACT configuration (minus HA and Admin accounts) is synch'd across both FWs.

Because both Active and Passive FW have the EXACT inside IP/mask, there needed to be a way to ensure the passive fw did NOT try to respond to arp requests, when it was in passive mode.

This is accomplished (and I think this the issue), by ensuring that the passive fw interfaces are administratively DOWN.

This seems to be the reason why you would not get LACP adjancency.

If you change the setting to up, it may assist in adjacency for LACP.

[BatD]

@ShaiW There is an option to configure passive HA firewall interfaces in state "Auto" and enable LACP, however this is only supported on the 3 and 5 series and not on the 820. See article below

https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/high-availability/ha-concepts/lacp-and-lld...

As @SCantwell_IM your only option is to configure passive interfaces to "shutdown", so at least you will not get LACP errorrs.