Suspended HA partner becomes active

Reply
Highlighted
L2 Linker

Suspended HA partner becomes active

We are in the process of setting up HA between two PA-5050 running PANOS 6.1.14. After configuring everything and testing failover in our main data center we performed "Suspend local device" on the passive node and shut it down to move it to our secondary site. After it was moved there and powered on we started to connect the various interfaces. This caused a major outage in our network, and when I connected to the console port on the (presumed) suspended firewall I saw that it had gone active. Is this a bug in PAN-OS, or did we miss a step somewhere?

Tags (4)

Accepted Solutions
Highlighted
L6 Presenter

Agreed. So firewall should recover from the (split brain scenario) after connectivity has been established. We had a similar situation. 

View solution in original post


All Replies
Highlighted
L6 Presenter

Suspend option will be "reset"  after reboot. How about your preemption option on the "passive" node after you fire it up?

 

 

https://live.paloaltonetworks.com/t5/Learning-Articles/Understanding-Preemption-with-the-Configured-...

 

Thx,

Myky

Highlighted
L2 Linker

Device priority on the firewall in our main data center is set to 100 and the other is set to 111. Preemption is enabled. I am guessing when the passive partner booted up without network connectivity and no longer suspended it assumed that the active partner was down and made itself active. Then the interfaces were connected and we got a split brain scenario.

Highlighted
L6 Presenter

Agreed. So firewall should recover from the (split brain scenario) after connectivity has been established. We had a similar situation. 

View solution in original post

Highlighted
Cyber Elite

Do you mean that after sometime suspended PA which become active changed the state to passive once network was restored

automatically?

MP
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!