Palo Alto Networks Knowledgebase: What is the Difference Between Auto and Shutdown Mode for Passive Link?

What is the Difference Between Auto and Shutdown Mode for Passive Link?

16098
Created On 11/03/19 11:21 AM - Last Updated 11/03/19 11:27 AM
Basic Configuration High Availability PAN-OS
Resolution

Overview

In a High Availability configuration the data interfaces of the passive device can be configured to either be down or up.
This "Passive Link State" setting can be found under Device > High Availability > Active/Passive Settings:

Active/Passive Link State

Passive-Link-state-settings

Shutdown mode

The passive link state is shutdown by default.
In this mode the physical link state of  data interfaces of the passive firewall will be down and displayed as red.
This option along with preemption can lead to preemptive loop, refer:When does an HA node go into Suspended state due to Preemption loop ?
Here is a sample of interface output. 
The right side is the Active device and the left is Passive. Passive device interface state is down.

Passive Link State Shutdown
CLI interface.png
 

Auto mode

This mode enables the link status on the passive firewall to reflect the actual physical link state.
This makes the physical interfaces stay 'up' on a passive device, but discards any packets received when in passive state.
This option allows faster failovers on Layer3 interfaces.
but could have unwanted side effects on Layer2 interfaces, as some switches may try to send packets over the 'up' interfaces.

In the below image, the difference of the passive link state which is UP when the option is set as auto as compared to the shutdown as shown above.auto state.pngPassive Link State Auto

 

Note: The IP and Mac addresses in the first image are highlighted to show that the L3 interfaces will have same virtual mac and ip addresses on both the Active and Passive devices of HA pair.

 

 



Additional Information
For further details refer:
https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/high-availability/set-up-activepassive-ha/configure-activepassive-ha.html

 


Attachments
Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClcACAS&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail

Attachments
Choose Language