PA L2 interface ARP problem

[DiogoFG]

Hi,

I have a PA with two switches connected to the PA via L2 interface, in trunk. The same switches have a trunk between them.

PA---SW1

|          |

SW2--|

So far so good, STP works and the network is stable. If one of the links between switch and PA falls (exemple PA to SW1) everything works too, all the traffic is redirect to PA via SW2, but as soon as link is became ok again, the Palo Alto ARP table does not refresh the Management VLAN and PA continues to think that the sw1 IP is seen by sw2.

Has anyone felt this behavior?

Regards

[OtakarKlier]

Hello,

Do you have the PAN in HA, e.g. are there two of them? Also why have the two switches trunked?

Regards,

[TomYoung]

Hi @DiogoFG ,

It looks like a STP design issue.  A say "design" because STP is working, just not as you expected.

1. The interface shown by "show arp all" is there for convenience.  It is not resolved by ARP but rather reflects the L2 forwarding table of "show mac all".
2. The PA does not participate in STP, but rather forwards the BPDUs to assist in loop prevention.  So, the STP topology looks like SW1=SW2 (the = represents 2 links).  It sounds like once the SW1-PA link goes down, once it comes back up it stays in STP blocking mode.  You can confirm what port is in STP blocking mode on the switch.
3. You should design the blocked port according to desired traffic flow.  If you want the direct link between SW1 and SW2 to always be in blocking state (when all links are up), then adjust your STP cost or priority accordingly on SW1 or SW2.

Thanks,

Tom

[DiogoFG]

Hi,

Yes there are two of them, with HA in Acive-Passive configuration. The trunk between switches is for redundancy reasons.

Regards,