Floating IP not moving to peer Firewall after HA failover(Active/Passive).

• The floating IP address stayed with the active firewall after failover.

• When an HA Failover occurs, pan_vm_plugin.log reports "Moving Secondary IP failed - Not able to get Peer's VNIC attachments"

  > less mp-log pan_vm_plugin.log
  -0600 vm_ha_state_trans INFO: Authenticate and retrieve an instance principal token
  -0600 vm_ha_state_trans INFO: Connection Error: HTTPSConnectionPool(host='auth.us-phoenix-1.oraclecloud.com', port=443):
  Max retries exceeded with url: /v1/x509 (Caused by NewConnectionError('<urllib3.connection.VerifiedHTTPSConnection object at 0x7fa5b5c6a5c0>: 
  Failed to establish a new connection: [Errno 110] Connection timed out',))
  -0600 vm_ha_state_trans INFO: : Moving Secondary IP failed - Not able to get Peer's VNIC attachments. Err: ConnError

• System state may not be updated with peer OCI instance id:

> show system state | match instance

ha.app.peer.platform: { 'eni': [ ], 'instance-id': NULL, }
peer.cfg.general.max-fibinstance: 0xff

• PA-VM
• PAN-OS
• Private & Public Cloud Space

• The issue was related to incorrect DNS resolution causing issues with OCI metadata retrieval, leading to incorrect failover behavior.
• Specifically, the DNS resolution is blocked by a proxy on management port.

1. Check if any node blocking management port connection to Oraclecloud url or related IP address, for example in the above example from pan_vm_plugin.log: https://auth.us-phoenix-1.oraclecloud.com/v1/x509
2. Remove the proxy server address for management port from Device > Setup > Services
3. Reboot the VM.
4. Performed failover test to ensure correct transitioning.
   
   

Configure Active/Passive HA on OCI