PA-5400 Series Port HA1 Down every time there is an upgrade

[Sitthichai]

Hi everyone,

I found a problem every time we upgrade the PA-5420 firmware. After the device reboots, port HA1 is always down. I tried to find the relevant logs. It could not find any reason for this happening.

Has anyone encountered this kind of problem? I want to know what is the root cause of this problem.

We directly connect Active and Passive.

We upgraded from PAN-OS 10.2.3 to 10.2.4 and encountered this problem on both devices.

We work around this by unplugging and re-inserting Port HA1 every time the device reboots.

Thank you.

[Sitthichai]

I see only log about "HA1 MAIN link flapping recovering after monitor-hold-time of 3000ms"

I'm not sure what caused it.

[KevinC-WVM]

Seeing the same on two of my PA-5420 pairs that are in Active/Passive configuration. They are using sfp-rj45 modules with cat 6a connecting the firewalls. Ran into it again today with the 10.2.4-h3 update.

[Nicholas.Moore]

I have pairs of PA-5410 in active/passive and I've had this problem every time I've upgraded - including to the latest preferred v10.2.4-h4.  The pairs go into a split-brain with HA1 showing down and it takes several minutes for the issue to resolve itself.  I do *not* have this problem on any of the PA-4x0 series in acitve/passive. 

[Sitthichai · Accepted solution]

Hey everyone I get summary in this case.

TAC informed me about the SFP issue.
I used copper SFP for HA1 and HA1-B.
TAC said it was a problem with the SFP driver itself not being compatible with the 5400 series. The solution was to switch to fiber sfp+ SR for HA1 and HA1-B, and I didn't have the problem again. When we reboot the device.

Hope it can help you.