sync issues

[jdprovine]

My HA pair went into split brain so I rebooted the secondary and now they will not sync

[TranceforLife]

Are they still able to communicate over the control plane? 

[jdprovine]

After hitting sync peer many times they finally worked and synced

[OtakarKlier]

Hello,

Do you have 'Device Priority' enabled? This does help with the split brian issues sometimes.

Election Settings

Specify or enable the following settings: • Device Priority—Enter a priority value to identify the active firewall. The firewall with the lower value (higher priority) becomes the active firewall (range is 0–255) when the preemptive capability is enabled on both firewalls in the pair.

Regards,

[TranceforLife]

The problem is if firewalls are unable to communicate (exchange "Heartbeat" messages) then each device assumes active role.

EDIT:

Ohh misread your message. Yes, you are right. I thought we are talking about preemption

[OtakarKlier]

Hello,

Yes that is true, however the split brain arises when communication is restored. So this should help solve that issue, correct?

Regards,

[Remo]

The device priority does not help you in split-brain situations. Split-brain is, as described by @TranceforLife, when the firewalls cannot communicate, so both peers assume the other one is down -> both change to active state.

The device priority is primary needed if you have one firewall which should, in most cases, handle the traffic. So in combination with preemptive mode, this makes sure that after a problemsituation is solved, the firewall with the higher priority (lower value) will change back to active.

If you don't care which firewall is active, there is actually no need to set different values (even if I recommend to do it anyway), because if both firewalls have the same value, the one with the lowest mac address will become the active clustermember.

@jdprovine

If you need to reboot the firewall after a split-brain to restore full functionality of the cluster, this sounds to me like a bug ... do you have PAN-OS 8.0.1 running?

[jdprovine]

@Remo

no i am currently on os 7.1.10, I think we are going to try to connect the heartbeat via fiber without running through switches or any other devices which seem to be the main cause in our situtation.