Palo Alto-7000 100G NPC QSFP 100G port is not coming up

Palo Alto-7000 100G NPC QSFP 100G port is not coming up

13138
Created On 01/13/24 01:52 AM - Last Modified 08/27/24 22:05 PM


Symptom


  • NPC card is installed in slot 1
> show chassis status
Slot       Component          Card Status        Config Status   Disabled  
1          PA-7000-100G-NPC-A Up                 Success                   
2          empty                                                           
3          empty                                                           
4          PA-7050-SMC-B      Up                 Success                   
5          empty                                                           
6          empty                                                           
7          empty                                                           
8          PA-7000-LFC-A      Up                 Success
  • While attempting to configure Ethernet 1/27 as a 100G port, despite enabling physical connectivity and verifying the functionality of the SFP, the interface does not come up.
  • Show interface all displays the following ports.
> show interface all
total configured hardware interfaces: 24
name                    id    speed/duplex/state            mac address       
--------------------------------------------------------------------------------
ethernet1/2             65    10000/full/up                 b4:0c:25:ef:c0:41 
ethernet1/3             66    10000/full/up                 b4:0c:25:ef:c0:42 
ethernet1/4             67    10000/full/up                 b4:0c:25:ef:c0:43 
ethernet1/5             68    10000/full/up                 b4:0c:25:ef:c0:44 
ethernet1/6             69    10000/full/up                 b4:0c:25:ef:c0:45 
ethernet1/17            80    ukn/ukn/down(autoneg)         b4:0c:25:ef:c0:50 
ethernet1/18            81    ukn/ukn/down(autoneg)         b4:0c:25:ef:c0:51 
ethernet1/19            82    ukn/ukn/down(autoneg)         b4:0c:25:ef:c0:52 
ethernet1/20            83    ukn/ukn/down(autoneg)         b4:0c:25:ef:c0:53 
ethernet1/25            88    40000/full/up                 b4:0c:25:ef:c0:58 
ethernet1/26            89    40000/full/up                 b4:0c:25:ef:c0:59 
ethernet1/27            90    ukn/ukn/down(autoneg)         b4:0c:25:ef:c0:5a <<<<<
ethernet1/28            91    40000/full/up                 b4:0c:25:ef:c0:5b 
ae1                     16    [n/a]/[n/a]/up                b4:0c:25:ef:c0:10 
ae2                     17    [n/a]/[n/a]/up                b4:0c:25:ef:c0:11 
ha1-a                   5     10000/full/up                 08:66:1f:02:da:26 
ha1-b                   7     10000/full/up                 08:66:1f:02:da:27 
vlan                    1     [n/a]/[n/a]/up                b4:0c:25:ef:c0:01 
loopback                3     [n/a]/[n/a]/up                b4:0c:25:ef:c0:03 
tunnel                  4     [n/a]/[n/a]/up                b4:0c:25:ef:c0:04 
hsci-a                  8     40000/full/up                 d4:1d:71:13:a2:08 
hsci-b                  9     40000/full/up                 d4:1d:71:13:a2:09 
lfc1/9                        40000/full/up                 d4:1d:71:13:a2:00 
lfc1/10                       40000/full/down(autoneg)      d4:1d:71:13:a2:00
  • brdagent logs show that the interface is often going to power-down state
2024-01-02 06:29:52.607 -0500 Port 27: Power up
2024-01-02 06:30:52.076 -0500 Port 27: Powered down
2024-01-02 06:31:04.146 -0500 Port 27: Power up
2024-01-02 16:01:00.142 -0500 Port 27: Powered down
2024-01-02 16:01:05.906 -0500 Port 27: Power up
2024-01-02 22:12:23.382 -0500 Port 27: Powered down
2024-01-02 22:12:29.061 -0500 Port 27: Power up



 


Environment


  • Palo Alto PA-7050 Firewalls
  • PA-7000 100G NPC
  • Breakout ports 
  • PAN-OS 10.0 and above


Cause


  • On a PA-7000 100G NPC,  the ports 25, 26, 27, and 28 can be configured as 40Gbps or 100Gbps.
  • On PAN-OS 10.0, 4 breakout ports can be configured on each interfaces (9-12, 13-16, 17-20, 21-24).
  • If breakout cable is not used, then ports 25-27 support 100 Gbps each (or 40Gbps if 40G QSFP+ is used).
  • In this example, the breakout ports 17-20 is already configured  and so Port port 27 cannot be configured as 100Gbps.
  • The information of this is documented here.
  • The interface information provides the ports 17-20 and 27 being configured.
ethernet1/17            80    ukn/ukn/down(autoneg)         b4:0c:25:ef:c0:50 
ethernet1/18            81    ukn/ukn/down(autoneg)         b4:0c:25:ef:c0:51 
ethernet1/19            82    ukn/ukn/down(autoneg)         b4:0c:25:ef:c0:52 
ethernet1/20            83    ukn/ukn/down(autoneg)         b4:0c:25:ef:c0:53 
.....
ethernet1/27            90    ukn/ukn/down(autoneg)         b4:0c:25:ef:c0:5a 

 


Resolution


  1. Either configure the QSFP port (PORT 27) or the breakout ports(17/18/19/20) - either one of them should be configured not both.
  2. In the above case, to bring up port 27
    1. Login to firewall GUI: Network > Interfaces > select the interface and 'delete' config. (from port 17/18/19/20)
    2. Set the interface state to down:
    3. Commit the changes
  • Corresponding CLI commands below:
> configure
#delete network interface ethernet ethernet1/17 
#delete network interface ethernet ethernet1/18 
#delete network interface ethernet ethernet1/19 
#delete network interface ethernet ethernet1/20 
#commit 
#exit 

 
 


Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000008WakCAE&lang=en_US&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail

Choose Language