Today’s task was get LACP working on a Palo Alto, so traffic and fault tolerance could be spread across multiple members of a Cisco 3750X switch stack. The default settings on the Palo Alto surprised me a bit, as I was expecting it to default to active and enable fast timers, but this was easy to set:
Unfortunately during testing, it still took a good minute for failover to work. This is because the standby unit disables interfaces until going active, so there’s a delay of 30-40 seconds for LACP bundling plus an additional 25-50 seconds for Spanning-Tree. Working around Spanning-Tree was easy: just use Edge port aka PortFast. Note it should be enabled at the channel level and ‘trunk’ must be added for it to work on trunk ports:
interface Port-channel4 description Palo Alto Firewall - LACP switchport trunk encapsulation dot1q switchport mode trunk logging event trunk-status logging event bundle-status spanning-tree portfast trunk !
Speeding up LACP took a bit more research. Apparently, only data center grade Cisco switches like the Catalyst 6500 and Nexus line support LACP 1-second fast timers out of the box. The Catalyst 3750 however will support fast timers on the bleeding edge 15.2(4)E train.
Upon testing, the failover downtime due to LACP bundling is now under 10 seconds:
Jul 20 17:58:22 PST: %EC-5-UNBUNDLE: Interface Gi4/1/1 left the port-channel Po31 Jul 20 17:58:22 PST: %EC-5-UNBUNDLE: Interface Gi3/1/1 left the port-channel Po31 Jul 20 17:58:30 PST: %EC-5-BUNDLE: Interface Gi3/1/2 joined port-channel Po32 Jul 20 17:58:32 PST: %EC-5-BUNDLE: Interface Gi4/1/2 joined port-channel Po32
2 thoughts on “LACP with Palo Alto Firewalls”
Upgrade PAN-OS and you can use “Enable in HA Passive State” which minimizes the downtime to round about 1 second 🙂
This is an option on the higher end platforms (3000/5000/7000) running software 7.1 or newer, yes.