The Aggregate Ethernet interface is showing down on a passive PA-7050 firewall of an active/passive HA pair. The HA Passive Link State is set to "Auto" under Device > High Availability > General >…

Question

Options

• AIt does not perform pre-negotiation LACP unless "Enable in HA Passive State" is selected
• BIt does not participate in LACP negotiation unless Fast Failover is selected under the Enable
• CIt participates in LACP negotiation when Fast is selected for Transmission Rate under the
• DIt performs pre-negotiation of LACP when the mode Passive is selected under the Enable

• A
  78% (18)
• B
  4% (1)
• C
  4% (1)
• D
  13% (3)

Explanation

When HA Passive Link State is set to 'Auto,' the passive firewall's interfaces are brought down to prevent the upstream switches from forwarding traffic to the passive unit. For standard interfaces, 'Auto' keeps them down on the passive node until failover occurs. For Aggregate Ethernet (AE) interfaces with LACP enabled, LACP negotiation (which would keep the physical link up) does NOT occur on the passive firewall unless 'Enable in HA Passive State' is explicitly checked in the AE interface configuration. Without that checkbox, the passive firewall does not send LACP PDUs and the switch considers the link down - which is the observed behavior. Option B (Fast Failover) relates to HA timer tuning, not LACP passive-state behavior. Options C and D describe incorrect conditions for how LACP behaves in passive mode.

No community discussion yet for this question.