Palo Alto 440 and FS 5860 Switches -- L2 Loop/Spanning-Tree issue

Question

I have identified what seems to be a looping issue, due to STP not blocking an alternate path. As you can see in the diagram, ports Eth7 and Eth8 on the switches connect to the Active/Passive PA-440 pair. Ports Eth2 and Eth3 on the Palo are Layer2 with vlans tagged on sub-interfaces (see picture). When BOTH Eth7 and Eth8 are UP-UP then performance will severely be degraded, i notice drops on the interfaces, drops on ping tests, and traffic bps spikes to 100mpbs+, which this is a non-production setup currently so there is not that much traffic. (Currently using FW02 for troubleshooting) If i shutdown Eth8 on SW01, then performance resumes.

I imagine the BPDU packets are not making it across the Palo interfaces back down towards the switchports.

Similar issue: https://weberblog.net/layer-2-redundancy-with-stp-palo-alto-firewall-cisco-switches/

**** DAL_SW01 ****
interface TenGigabitEthernet 0/7
 description to DAL-PA-FW01-ETH2
 switchport mode trunk
 switchport trunk allowed vlan only 600
!
interface TenGigabitEthernet 0/8
 description to DAL-PA-FW02-ETH3
 shutdown
 switchport mode trunk
 switchport trunk allowed vlan only 600
!
interface AggregatePort 1
 description to DAL_SW02
 switchport mode trunk

*** DAL_SW02 ***
interface TenGigabitEthernet 0/7
 description to DAL-PA-FW02-ETH2
 switchport mode trunk
 switchport trunk allowed vlan only 600
!
interface TenGigabitEthernet 0/8
 description to DAL-PA-FW01-ETH3
 switchport mode trunk
 switchport trunk allowed vlan only 600
DAL_SW02#show running-config int ag1  
!
interface AggregatePort 1
 description to DAL_SW01
 switchport mode trunk

**** PA-440 ****
ethernet1/2 {
  layer2 {
    lldp {
      profile ETH2-LLDP-PROFILE;
      enable yes;
    }
    units {
      ethernet1/2.600 {
        tag 600;
      }
      ethernet1/2.1 {
        tag 1;
      }
    }
  }
  lacp {
    port-priority 32768;
  }
  comment "to DAL_SW01 (Eth7)";
}

ethernet1/3 {
  layer2 {
    lldp {
      enable no;
    }
    units {
      ethernet1/3.600 {
        tag 600;
      }
      ethernet1/3.1 {
        tag 1;
      }
    }
  }
  comment "to DAL_SW02 (Eth8)";
}

Answer 1

Your are trunking VLANs 1 and 600 across the Palo Altos on the bridged ports ethernet1/2 and ethernet1/3. However, the PAs are apparently not taking part in the RSTP. If we assume they're not forwarding BPDUs from the 5860s (in conformance to IEEE 802.1Q) then there's the loop.

You can check whether BPDUs run across the PAs by checking the BPDU counters on the 5680s (something along show spanning-tree statistics). Cheap/simple switches often forward BPDUs regardlessly but any decent gear should filter them.

Without BPDUs running between ports, the 5860s cannot recognize the redundant link and they cannot block forwarding.

IEEE BPDUs are quite different from Cisco PVST BPDUs that run inside VLANs (=they're tagged on trunks) and are forwarded by most non-Cisco devices.

Either you break the bridge on the PAs (use L3 ports instead of L2 ones) or you need to make them run RSTP (no idea if they can).