Passive device aggregate interface down

[Jafar_Hussain]

I have the firewall 3220 model in the 9.1.11 version in HA mode.

I can see all the aggregate interface in passive firewall is showing down. i want to know is this expected behaviour or not because I checked the below KB for some mode it is expected behaviour.

Aggregate Interface Down on Passive Device - Knowledge Base - Palo Alto Networks

moreover, my concern is at the last time the failover happen the passive device was not accessible as well as the traffic has stopped.

[BPry]

@Jafar_Hussain,

By default, this is expected on a passive device. As the article that you have linked mentions, you can get the passive node to participate in LACP pre-negotiation by enabling it on the AE interface/s by going to the lamp tab and setting passive-pre-negotiation. 

This allows the passive interfaces to participate in LACP communication, but still drops the rest of the traffic on the passive node. 

Without knowing more about your network and configuration, it's hard to say why the failover would make the passive node unaccessible and cause all of your traffic to stop. You could have run into an LACP issue and your switch could have blocked the ports, or a number of other things that could cause outages. 

[Jafar_Hussain]

@BPry 

I have configured AE1 group with interface ethernet 1/17 and ethernet 1/18

once I took the output for the active and passive that time I found the key for the partner I am not able to see on the passive firewall. below is the output:-

Active firewall output:-

***************************************************

AE group: ae1

Members:          Bndl Rx state       Mux state  Sel state

  ethernet1/17    yes  Current        Tx_Rx      Selected

  ethernet1/18    yes  Current        Tx_Rx      Selected

Status:           Enabled

Mode:             Active

Rate:             Slow

Max-port:         8

Fast-failover:    Disabled

Pre-negotiation:  Enabled

Local:            System Priority: 32768

                  System MAC:      x:x:x:x

                  Key:             16

Partner:          System Priority: 32768

                  System MAC:      x:x:x:x

                  Key:             11

Port State

--------------------------------------------------------------------------------

Interface                 Port

              Number Priority  Mode    Rate  Key      State

--------------------------------------------------------------------------------

ethernet1/17   80     32768    Active  Slow  16       0x3D

Partner        306    32768    Active  Slow  11       0x3D

ethernet1/18   81     32768    Active  Slow  16       0x3D

Partner        562    32768    Active  Slow  11       0x3D

Port Counters

--------------------------------------------------------------------------------

Interface         LACPDUs         Marker      Marker Response       Error

              Sent     Recv     Sent Recv     Sent     Recv     Unknown  Illegal

--------------------------------------------------------------------------------

ethernet1/17   111857   120904   0    0        0        0        0        0

ethernet1/18   111855   120931   0    0        0        0        0        0

*************************************************************************************

LACP output of the passive firewall"-

***********************************************************

AE group: ae1

Members:          Bndl Rx state       Mux state  Sel state

  ethernet1/17    no   Defaulted      Detached   Unselected(Peer not detected)

  ethernet1/18    no   Defaulted      Detached   Unselected(Peer not detected)

Status:           Enabled

Mode:             Active

Rate:             Slow

Max-port:         8

Fast-failover:    Disabled

Pre-negotiation:  Enabled

Local:            System Priority: 32768

                  System MAC:      x:x:x:x

                  Key:             16

Partner:          System Priority: 0

                  System MAC:      00:00:00:00:00:00

                  Key:             0

Port State

--------------------------------------------------------------------------------

Interface                 Port

              Number Priority  Mode    Rate  Key      State

--------------------------------------------------------------------------------

ethernet1/17   80     32768    Active  Slow  16       0x45

Partner        0      0        Passive Slow  0        0x00

ethernet1/18   81     32768    Active  Slow  16       0x45

Partner        0      0        Passive Slow  0        0x00

Port Counters

--------------------------------------------------------------------------------

Interface         LACPDUs         Marker      Marker Response       Error

              Sent     Recv     Sent Recv     Sent     Recv     Unknown  Illegal

--------------------------------------------------------------------------------

ethernet1/17   111943   0        0    0        0        0        0        0

ethernet1/18   111874   0        0    0        0        0        0        0

*************************************************************************************************

On the passive firewall output for the AE1 :- I noticed that the prenegotiation is enabled but I didn't get the partner MAC address even I didn't get the partner key for the ethernet 1/17 and ethernet 1/18.

One more point I highlight in the port counter LACPDU's the packets is sending but didn't receive any output.

I would like to know, is this expected or do I need to check something on this.

[Jafar_Hussain · Accepted solution]

@BPry 

The device was faulty. we replace the device.

[Maria-Victoria]

hello is possible to know how was checked that the fw was faulty? I have the same problem