Traffic is silently discarded/dropped in Active/Active HA implementation

7788

Created On 06/14/23 13:50 PM - Last Modified 11/13/23 11:04 AM

Active-Active

High Availability

PAN-OS

Strata

Symptom

FW1 receives an initial packet for a new session and becomes the session owner.
FW1 finds out that FW2 is the session setup, so it forwards the packet via HA3 to FW2.
Once the packet is received by FW2, it does the slowpath and determines ingress and egress interfaces during the session setup.
FW2 then sends the packet back to FW1, using HA3 link for Layer 7 processing, if any.
FW1 attempts to forward the packet out the egress interface to the destination based on the session information received from FW2.
If the egress interface or sub-interface number in the session received from FW2 differs from the egress interface or sub-interface configured on FW1, the packet gets discarded.
As a result, the global counters ha_aa_session_setup_too_many_retry, flow_no_interface and flow_arp_rcv_err may increment when the issue is taking place.

The packet capture taken on the firewall will show dropped SYN retransmissions

Suspending any of the firewall nodes solves the problem.

Environment

PAN-OS: All
High Avalability: Active/Active

Cause

The sub-interfaces numbers or interfaces used for the same ingress/egress traffic are different on Active Primary and Active Secondary firewall nodes.

Example:

Active Primary: ethernet1/7.40 VLAN ID 40
Active Secondary: ethernet1/7.30 VLAN ID 30

OR:

Active Primary: ethernet1/1
Active Secondary: ethernet1/2

Resolution

Change the sub-interface numbers or interfaces to make them identical on both firewall nodes. The VLAN IDs may remain unchanged.

Example:

Active Primary: ethernet1/7.40 VLAN ID 40
Active Secondary: ethernet1/7.40 VLAN ID 30

OR:

Active Primary: ethernet1/1
Active Secondary: ethernet1/1

Additional Information