启用加密的 HA1 控制链路，从 9.1 升级到 10.0 后一直在抖动

15063

Created On 07/29/22 17:16 PM - Last Modified 09/25/24 13:47 PM

Symptom

在主动/被动或主动/主动HA设置，从 9.1 升级到 10.0 后，HA1 链接不断抖动：

2022/05/21 13:48:57 critical ha             connect 0  HA Group 4: Control link running on HA1-Backup connection
2022/05/21 13:48:56 critical ha             connect 0  HA Group 4: All HA1 connections down
2022/05/21 13:48:56 critical ha             connect 0  HA Group 4: HA1 connection down
2022/05/21 13:48:54 info     ha             connect 0  HA Group 4: HA1 connection up
2022/05/21 13:48:54 info     ha             ha1-lin 0  HA1-Backup peer link up
2022/05/21 13:48:54 info     ha             ha1-lin 0  HA1 peer link up
2022/05/21 13:48:54 info     ha             connect 0  HA Group 4: Control link running on HA1 connection
2022/05/21 13:48:53 critical ha             connect 0  HA Group 4: All HA1 connections down
2022/05/21 13:48:53 high     ha             connect 0  HA Group 4: HA1-Backup connection down
2022/05/21 13:48:51 info     ha             connect 0  HA Group 4: HA1-Backup connection up
2022/05/21 13:48:51 info     ha             ha1-lin 0  HA1-Backup peer link up
2022/05/21 13:48:51 info     ha             ha1-lin 0  HA1 peer link up
2022/05/21 13:48:51 critical ha             connect 0  HA Group 4: Control link running on HA1-Backup connection
2022/05/21 13:48:50 critical ha             connect 0  HA Group 4: All HA1 connections down
2022/05/21 13:48:50 critical ha             connect 0  HA Group 4: HA1 connection down
2022/05/21 13:48:48 info     ha             connect 0  HA Group 4: HA1 connection up
2022/05/21 13:48:48 info     ha             ha1-lin 0  HA1-Backup peer link up
2022/05/21 13:48:48 info     ha             ha1-lin 0  HA1 peer link up

在 ha_agent 日志中看到的错误消息：

mp        ha_agent.log                       2022-05-21 13:40:56   2022-05-21 13:40:56.170 +1000 debug: ha_peer_send_error(src/ha_peer.c:1725): Group 4 (HA1-MAIN): Sending errro message
mp        ha_agent.log                       2022-05-21 13:40:56   
mp        ha_agent.log                       2022-05-21 13:40:56   Error Msg
mp        ha_agent.log                       2022-05-21 13:40:56   ---------
mp        ha_agent.log                       2022-05-21 13:40:56   flags    : 0x2 (close:)
mp        ha_agent.log                       2022-05-21 13:40:56   err code : SSH Tunnel reset (17)
mp        ha_agent.log                       2022-05-21 13:40:56   num tlvs : 1
mp        ha_agent.log                       2022-05-21 13:40:56     Printing out 1 tlvs
mp        ha_agent.log                       2022-05-21 13:40:56     TLV[1]: type 5 (ERR_STRING); len 17; value:
mp        ha_agent.log                       2022-05-21 13:40:56       53534820 54756e6e 656c2072 65736574 00
mp        ha_agent.log                       2022-05-21 13:40:56   
mp        ha_agent.log                       2022-05-21 13:40:56   2022-05-21 13:40:56.170 +1000 Error:  ha_peer_disconnect(src/ha_peer.c:1860): Group 4 (HA1-MAIN): peer connection error msg set: SSH Tunnel reset

HA1 上启用了加密：

> show high-availability all 

<snip>

Jumbo-Frames disabled; MTU 1500
HA1 Control Links Joint Configuration:
Link Monitor Interval: 3000 ms
Encryption Enabled: yes.  <<<<<<<<

Environment

HA 从 9.1 升级到 10.0

Cause

这是预期的行为，直到HA升级完成
在 10.0 中，我们使用 aes128-ctrSSH而在 9.1 中，我们使用 aes128-cbc。由于算法的差异，SSH隧道不断重置，因此 HA1 襟翼

Resolution

由于上面提到的根本原因，建议禁用 HA1 加密

第 6 步：https://docs.paloaltonetworks.com/pan-os /10-0/pan-os -新功能/升级-pan-os /升级-firewall -pan-os /upgrade-an-ha-firewall -对#id062f1ad5-adb3-4d25-b4a4-529bde5dc96a

1. 选择 DeviceHigh AvailabilityGeneral 并编辑 Control Link (HA1) 部分。
2. 取消选中“Encryption Enabled”以禁用它。
3. 提交更改HA两个同龄人。

Additional Information