Salesforce

When does an HA node go into Suspended state due to Preemption loop ?

« Go Back

Information

 
TitleWhen does an HA node go into Suspended state due to Preemption loop ?
URL NameWhen-does-an-HA-node-go-into-S-67706
Summary
Validation StatusValidated - External
Symptom
One of the firewalls in a High Availability pair (HA) moves into the "suspended" state due to Preemption loop.

suspended (Preemption loop detected)
preemption-loop

The device which has a higher priority and a lower value, moves into this state of suspended (Preemption loop detected)

This is slightly different from device going to suspended state due to non-functional loop. 
Refer: When does an HA node go into Suspended state due to Non-Functional loop?
Environment
  • Devices in High Availability HA configuration.
  • The individual nodes are configured with a priority value and pre-emption enabled to advocate prioritisation of an individual node.
  • Link monitoring OR path monitoring is configured on individual nodes.

 
Cause
The following sequence of events can cause the failure :
  • When a link or path monitoring (or both) failure condition is detected, the Active device moves to non-functional state. Refer: https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/high-availability/ha-firewall-states.html
  • When the link/path monitoring is up, the non-functional nodes moves into passive state.
  • Since preemption is enabled in the setup, the passive device, which has a higher priority and a lower value, moves into the active state.
  • If further instances of failure conditions are encountered, such as link OR path monitoring, the active node will keep changing its state from Active > Non-functional > Passive > Active.
  • The node moves into "Suspend" state due to preemption loop if "Maximum number of flaps" are observed.
  • A flap is counted when the firewall leaves the active state within 15 minutes after it last left the active state. 
  • This value indicates the maximum number of flaps that are permitted before the firewall is suspended and the passive firewall takes over (range 0-16, default 3).
  • Maximum number of flaps can be configured as follows:
max-flaps


 
Resolution

A node in suspended state can only be made functional (Active or Passive) manually.
Refer:How to Recover HA Pair Member from the Suspended State

Before making the node functional, consider the following recommendations :
  • Investigate and the fix the issue of the interface and/or path monitoring flaps.
  • If the node is made functional in an unstable environment, it will likely move into a suspended state again. 
  • Remove the preempt option from the nodes until the monitoring status is stable.
  • This will help the healthy node retain the Active state, while the node encountering flaps will remain in the non-functional/passive state for investigation.
  • If preempt is enabled it is recommended to also set the "Passive Link State" setting to "Auto" to prevent the above scenario from occurring.
  • This will keep the interfaces in a physically 'up' state that allows the system to detect if an interface is physically down before allowing preempt to re-activate the device. Refer What is the Difference Between Auto and Shutdown Mode for Passive Link?


After following the steps in How to Recover HA Pair Member from the Suspended State, the affected node moves into  "Passive" state and eventually to the "Active" state due to preemption and its high priority.

Additional Information
Legacy ID67706
Legacy Urlhttp://live.paloaltonetworks.com:80/t5/Management-Articles/When-does-an-HA-node-go-into-Suspended-state-due-to-Preemption/ta-p/67706
Attachment 1 
Attachment 2 
Attachment 3 
Attachment 4 
Attachment 5 
Auto Assistant Signature

Powered by