Hi all, i'm setting up two PA 5020 in Active/Passive HA and I'm having some problems with Aggregate interfaces. I'm using 4 ethernet interfaces per device: ae.1 - trust zone (two physical ethernet interfaces) ae.2 - untrust zone (two physical ethernet interfaces) The device is operating in L3 mode with static routes. If I use a single device, all works flawlessly. If i try to enable HA i start getting packet loss (>5-10% in a LAN environment). If i try to shutdown one of the ports for each port-channel, i'm still getting packet loss. I've also tried to reconfigure the HA pair without Aggregate interfaces and in this case all works perfectly. I really cannot undestand why i'm getting so much packet loss, it doesn't seem to be just an aggregate ethernet issue, because with a single device it works... it also doesn't seem to be only an ha issue, because in ha without aggregate ethernet interfaces it just works perfectly... but when i'm using both ae and ha it just blows up 😞 On the switch side, all seems ok, no errors, nothing strange. Here some configuration snippets, maybe it's just a stupid issue... i'm a newb with this gear 😉 The switch configuration ( cisco 3750 right now, also tried with a 6509 with the same results): interface Port-channel9 description * FW1 - Trust * switchport trunk encapsulation dot1q switchport trunk native vlan 900 switchport trunk allowed vlan 900 switchport mode trunk switchport nonegotiate spanning-tree portfast trunk ! interface Port-channel10 description * FW1 - Untrust * switchport trunk encapsulation dot1q switchport trunk native vlan 901 switchport trunk allowed vlan 901 switchport mode trunk switchport nonegotiate spanning-tree portfast trunk ! interface Port-channel19 description * FW2 - Trust * switchport trunk encapsulation dot1q switchport trunk native vlan 900 switchport trunk allowed vlan 900 switchport mode trunk switchport nonegotiate spanning-tree portfast trunk ! interface Port-channel20 description * FW2 - Untrust * switchport trunk encapsulation dot1q switchport trunk native vlan 901 switchport trunk allowed vlan 901 switchport mode trunk switchport nonegotiate spanning-tree portfast trunk ! interface FastEthernet1/0/1 description * PAN-FW1 - Trust * switchport trunk encapsulation dot1q switchport trunk native vlan 900 switchport trunk allowed vlan 900 switchport mode trunk switchport nonegotiate channel-group 9 mode on spanning-tree portfast trunk ! interface FastEthernet1/0/2 description * PAN-FW1 - Trust * switchport trunk encapsulation dot1q switchport trunk native vlan 900 switchport trunk allowed vlan 900 switchport mode trunk switchport nonegotiate channel-group 9 mode on spanning-tree portfast trunk ! interface FastEthernet1/0/3 description * PAN-FW1 - Untrust * switchport trunk encapsulation dot1q switchport trunk native vlan 901 switchport trunk allowed vlan 901 switchport mode trunk switchport nonegotiate channel-group 10 mode on spanning-tree portfast trunk ! interface FastEthernet1/0/4 description * PAN-FW1 - Untrust * switchport trunk encapsulation dot1q switchport trunk native vlan 901 switchport trunk allowed vlan 901 switchport mode trunk switchport nonegotiate channel-group 10 mode on spanning-tree portfast trunk ! interface FastEthernet1/0/13 description * PAN-FW2 - Trust * switchport trunk encapsulation dot1q switchport trunk native vlan 900 switchport trunk allowed vlan 900 switchport mode trunk switchport nonegotiate channel-group 19 mode on spanning-tree portfast trunk ! interface FastEthernet1/0/14 description * PAN-FW2 - Trust * switchport trunk encapsulation dot1q switchport trunk native vlan 900 switchport trunk allowed vlan 900 switchport mode trunk switchport nonegotiate channel-group 19 mode on spanning-tree portfast trunk ! interface FastEthernet1/0/15 description * PAN-FW2 Untrust * switchport trunk encapsulation dot1q switchport trunk native vlan 901 switchport trunk allowed vlan 901 switchport mode trunk switchport nonegotiate channel-group 20 mode on spanning-tree portfast trunk ! interface FastEthernet1/0/16 description * PAN-FW2 Untrust * switchport trunk encapsulation dot1q switchport trunk native vlan 901 switchport trunk allowed vlan 901 switchport mode trunk switchport nonegotiate channel-group 20 mode on spanning-tree portfast trunk !
... View more