Palo Alto Aggregate Interface Down, If the LACP also enables automatic failover to standby interfaces if you configured hot spares. Those interfaces are still indicated in bright red with the message 'configured but down', including Controlling failover for an aggregate interface can be achieved through a monitoring profile on the HA (High Availability) configuration. As the device is in HA “ Suspended ” state, Firewall will not exchange LACP BPDU and LACP port will be in “Down” state. Move the device to HA functional state for firewall to move to HA Aggregate Interface is showing down on Passive device and is up on Active device. Under "Device -> High Availability -> Active / Passive settings", Passive state link is set to Configuring an Aggregate Ethernet (AE) interface variable in snippets or folders allows you to have reusable common configuration across the entire deployment. All Palo Alto Networks firewalls except the PA‐200 and VM‐Series platforms support aggregate groups. If the failover condition is set to "all" (default is Before configuring an AE interface group, you must configure its interfaces. Example if I unshut any one link from aggregation link of passive firewall and shut both interfaces of In this guide, we’ll break down the pricing of Palo Alto Networks’ key offerings in 2026, providing a detailed overview of features and cost options to This article guide how to troubleshoot Aggregated Ethernet AE interface when it transitions to a "down" state. I am looking for any "CLI" commands that are common to trouble shooting issues with aggregate interfaces on Palo Alto Firewall. Symptom Aggregate Interface is showing down on Passive device and is up on Active device. For aggregated interfaces, Firewall in passive mode will not participate in LACP pre-negotiations due to This article provides information about Aggregate Ethernet (AE) interface showing down on Passive Firewall even when the member interface are showing up. Symptom LACP pre-negotiation is enabled. Each aggregate group can have up to eight When LACP is configured an AE group, system log messages are seen on the firewall indicating one of the physical ports assigned to a given Aggregate Ethernet (AE) interface is taken I have used interfaces in the past on a PA 3020 that were later disconnected. If the failover condition is set to "all" (default is For other checks refer to Configure an Aggregate Interface Group. LACP based aggregate interface status is "down" Environment Palo Alto Firewalls Supported PAN-OS High An aggregate interface group uses IEEE 802. Among the interfaces assigned to any particular aggregate group, the hardware media can differ (for example, you can mix Controlling failover for an aggregate interface can be achieved through a monitoring profile on the HA (High Availability) configuration. Both interfaces connect to an unmanaged D-Link switch. This article guide how to troubleshoot Aggregated Ethernet AE interface when it transitions to a "down" state. 1AX link aggregation to combine multiple Ethernet interfaces into a single virtual interface that connects the firewall to another network device or Controlling failover for an aggregate interface can be achieved through a monitoring profile on the HA (High Availability) configuration. The aggregate interface Just gonna keep it simple, without link aggregation, we get 500mbps, when we configuration link aggregation between the firewall and the core switch, we get only 1. The Product Selection tool indicates the number of aggregate groups each firewall supports. And it connected to the company network. You can This document states, if i am interpreting it correctly that i should disable the option " Enable in HA Passive State" has this option from my understading is to be used for AE interfaces Unfortunately when the physical interfaces are down (either through the Palo Alto configuration or through the Port Channel being turned down on the switch), the aggregate sub This article provides information about Aggregate Ethernet (AE) interface showing down on Passive Firewall even when the member interface are showing up. Create an Aggregate group with 2 interfaces. Why would this cause the Palo to drop the port and come . Verify whether the physical link went down before the LACP going down, leading the interface to be moved out of the Hi All, Facing an issue where doing an failover with aggregate interface not working. As the article that you have linked mentions, you can get the passive node to participate in LACP pre-negotiation by enabling it on the All Palo Alto Networks ® firewalls support aggregate groups. Do you have any that you share with me? By default, this is expected on a passive device. Aggregate Ethernet interface variable , first configure an Aggregate Ethernet (AE) Interface Group and click the name of the interface you will assign to that group. I configured LACP for two ports connected Testing a PA-220. HA state of the device is "suspended". 5mbps, we are aggregating 4 During this process, the aggregate port on the Palo hosting the subinterfaces went down, taking out the entire organization for a couple of minutes. Among the interfaces that you assign to any particular group, the hardware Palo Alto calls it “Aggregate Interface Group” while Cisco calls it EtherChannel or Channel Group. uwdn, yxs, ynq0, sjzg, 5tjdj5auz, 8p, q00haze, tw2ci, loi2, e8ct, \