High Availability Clusters of Palo Alto Networks Devices Have the Same Virtual MAC Address
Resolution
Issue
Two Palo Alto Networks devices from different High Availability (HA) clusters have the same virtual MAC address:
admin@Cluster01(active)> show arp all
interface ip address hw address port status ttl
--------------------------------------------------------------------------------
ethernet1/3.129 10.15.63.10 00:1b:17:00:01:12 ethernet1/3 c 1410
admin@Cluster02(active)> show arp all
interface ip address hw address port status ttl
--------------------------------------------------------------------------------
ethernet1/3.129 10.15.63.15 00:1b:17:00:01:12 ethernet1/3 c 1615
The MAC address can also be checked with following command:
>show interface etherenet1/1
Resolution
The issue only happens when the HA clusters are configured with the same HA Group ID and is resolved by configuring different group ID for the HA clusters. When HA is enabled, a virtual MAC address is applied to all interfaces of the firewall. This virtual MAC address is generated based on the Group ID.
See Also
How to Calculate a Virtual MAC Address
How to Track Switch Ports Associated with HA Active/Passive Pair if Physical Access is Not Available