Palo Alto-7000 100G NPC QSFP 100G port is not coming up
13136
Created On 01/13/24 01:52 AM - Last Modified 08/27/24 22:05 PM
Symptom
- NPC card is installed in slot 1
> show chassis status
Slot Component Card Status Config Status Disabled
1 PA-7000-100G-NPC-A Up Success
2 empty
3 empty
4 PA-7050-SMC-B Up Success
5 empty
6 empty
7 empty
8 PA-7000-LFC-A Up Success
- While attempting to configure Ethernet 1/27 as a 100G port, despite enabling physical connectivity and verifying the functionality of the SFP, the interface does not come up.
- Show interface all displays the following ports.
> show interface all
total configured hardware interfaces: 24
name id speed/duplex/state mac address
--------------------------------------------------------------------------------
ethernet1/2 65 10000/full/up b4:0c:25:ef:c0:41
ethernet1/3 66 10000/full/up b4:0c:25:ef:c0:42
ethernet1/4 67 10000/full/up b4:0c:25:ef:c0:43
ethernet1/5 68 10000/full/up b4:0c:25:ef:c0:44
ethernet1/6 69 10000/full/up b4:0c:25:ef:c0:45
ethernet1/17 80 ukn/ukn/down(autoneg) b4:0c:25:ef:c0:50
ethernet1/18 81 ukn/ukn/down(autoneg) b4:0c:25:ef:c0:51
ethernet1/19 82 ukn/ukn/down(autoneg) b4:0c:25:ef:c0:52
ethernet1/20 83 ukn/ukn/down(autoneg) b4:0c:25:ef:c0:53
ethernet1/25 88 40000/full/up b4:0c:25:ef:c0:58
ethernet1/26 89 40000/full/up b4:0c:25:ef:c0:59
ethernet1/27 90 ukn/ukn/down(autoneg) b4:0c:25:ef:c0:5a <<<<<
ethernet1/28 91 40000/full/up b4:0c:25:ef:c0:5b
ae1 16 [n/a]/[n/a]/up b4:0c:25:ef:c0:10
ae2 17 [n/a]/[n/a]/up b4:0c:25:ef:c0:11
ha1-a 5 10000/full/up 08:66:1f:02:da:26
ha1-b 7 10000/full/up 08:66:1f:02:da:27
vlan 1 [n/a]/[n/a]/up b4:0c:25:ef:c0:01
loopback 3 [n/a]/[n/a]/up b4:0c:25:ef:c0:03
tunnel 4 [n/a]/[n/a]/up b4:0c:25:ef:c0:04
hsci-a 8 40000/full/up d4:1d:71:13:a2:08
hsci-b 9 40000/full/up d4:1d:71:13:a2:09
lfc1/9 40000/full/up d4:1d:71:13:a2:00
lfc1/10 40000/full/down(autoneg) d4:1d:71:13:a2:00
- brdagent logs show that the interface is often going to power-down state
2024-01-02 06:29:52.607 -0500 Port 27: Power up
2024-01-02 06:30:52.076 -0500 Port 27: Powered down
2024-01-02 06:31:04.146 -0500 Port 27: Power up
2024-01-02 16:01:00.142 -0500 Port 27: Powered down
2024-01-02 16:01:05.906 -0500 Port 27: Power up
2024-01-02 22:12:23.382 -0500 Port 27: Powered down
2024-01-02 22:12:29.061 -0500 Port 27: Power up
Environment
- Palo Alto PA-7050 Firewalls
- PA-7000 100G NPC
- Breakout ports
- PAN-OS 10.0 and above
Cause
- On a PA-7000 100G NPC, the ports 25, 26, 27, and 28 can be configured as 40Gbps or 100Gbps.
- On PAN-OS 10.0, 4 breakout ports can be configured on each interfaces (9-12, 13-16, 17-20, 21-24).
- If breakout cable is not used, then ports 25-27 support 100 Gbps each (or 40Gbps if 40G QSFP+ is used).
- In this example, the breakout ports 17-20 is already configured and so Port port 27 cannot be configured as 100Gbps.
- The information of this is documented here.
- The interface information provides the ports 17-20 and 27 being configured.
ethernet1/17 80 ukn/ukn/down(autoneg) b4:0c:25:ef:c0:50
ethernet1/18 81 ukn/ukn/down(autoneg) b4:0c:25:ef:c0:51
ethernet1/19 82 ukn/ukn/down(autoneg) b4:0c:25:ef:c0:52
ethernet1/20 83 ukn/ukn/down(autoneg) b4:0c:25:ef:c0:53
.....
ethernet1/27 90 ukn/ukn/down(autoneg) b4:0c:25:ef:c0:5a
Resolution
- Either configure the QSFP port (PORT 27) or the breakout ports(17/18/19/20) - either one of them should be configured not both.
- In the above case, to bring up port 27
- Login to firewall GUI: Network > Interfaces > select the interface and 'delete' config. (from port 17/18/19/20)
- Set the interface state to down:
- Commit the changes
- Corresponding CLI commands below:
> configure
#delete network interface ethernet ethernet1/17
#delete network interface ethernet ethernet1/18
#delete network interface ethernet ethernet1/19
#delete network interface ethernet ethernet1/20
#commit
#exit