PA L2 interface ARP problem

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.

PA L2 interface ARP problem

L0 Member



I have a PA with two switches connected to the PA via L2 interface, in trunk. The same switches have a trunk between them.



|          |



So far so good, STP works and the network is stable. If one of the links between switch and PA falls (exemple PA to SW1) everything works too, all the traffic is redirect to PA via SW2, but as soon as link is became ok again, the Palo Alto ARP table does not refresh the Management VLAN and PA continues to think that the sw1 IP is seen by sw2.


Has anyone felt this behavior?







Cyber Elite
Cyber Elite


Do you have the PAN in HA, e.g. are there two of them? Also why have the two switches trunked?


Cyber Elite
Cyber Elite

Hi @DiogoFG ,


It looks like a STP design issue.  A say "design" because STP is working, just not as you expected.


  1. The interface shown by "show arp all" is there for convenience.  It is not resolved by ARP but rather reflects the L2 forwarding table of "show mac all".
  2. The PA does not participate in STP, but rather forwards the BPDUs to assist in loop prevention.  So, the STP topology looks like SW1=SW2 (the = represents 2 links).  It sounds like once the SW1-PA link goes down, once it comes back up it stays in STP blocking mode.  You can confirm what port is in STP blocking mode on the switch.
  3. You should design the blocked port according to desired traffic flow.  If you want the direct link between SW1 and SW2 to always be in blocking state (when all links are up), then adjust your STP cost or priority accordingly on SW1 or SW2.




Help the community: Like helpful comments and mark solutions.



Yes there are two of them, with HA in Acive-Passive configuration. The trunk between switches is for redundancy reasons.



  • 3 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!