Use of HA2 and HA3 port Active-Active-Active

[Alpalo]

Hello,
We have changed PA-5220(10.1.6-h6) by the PA-3420(10.2.5) , and we have detected that much more traffic is being sent by the HA2 and HA3 ports.
Being unbalanced, it saturates a port of HA2 and may cause an error in the synchronization of sessions.

Does anyone know how to check this or know the reason why this is happening?

Thanks

[TomYoung]

Hi @Alpalo ,

The HA ports have different functions.

HA1 = Control Link

HA2 = Data Link

HA3 = Packet-Forwarding Link

The detailed explanation is here -> https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/high-availability/ha-concepts/ha-links-and....

So, there is no way to balance the traffic over multiple HA links.  The solution is to upgrade the HA2 port (and the HA2-Backup if configured).  If it is currently 1G, change to a 10G port.  If it is 10G, change to a 25G port.  The best 10G for direct connect would be PAN-SFP-PLUS-CU-5M or equivalent.  I don't see a direct connect 25G cable.  Maybe the PAN-QSFP28-DAC-5M would work, but you would need to confirm.  It is a shame PANW does not make these cables in smaller lengths (that I have found).

Thanks,

Tom