0

I have identified what seems to be a looping issue, due to STP not blocking an alternate path. As you can see in the diagram, ports Eth7 and Eth8 on the switches connect to the Active/Passive PA-440 pair. Ports Eth2 and Eth3 on the Palo are Layer2 with vlans tagged on sub-interfaces (see picture). When BOTH Eth7 and Eth8 are UP-UP then performance will severely be degraded, i notice drops on the interfaces, drops on ping tests, and traffic bps spikes to 100mpbs+, which this is a non-production setup currently so there is not that much traffic. (Currently using FW02 for troubleshooting) If i shutdown Eth8 on SW01, then performance resumes.

I imagine the BPDU packets are not making it across the Palo interfaces back down towards the switchports.

Similar issue: https://weberblog.net/layer-2-redundancy-with-stp-palo-alto-firewall-cisco-switches/

**** DAL_SW01 ****
interface TenGigabitEthernet 0/7
 description to DAL-PA-FW01-ETH2
 switchport mode trunk
 switchport trunk allowed vlan only 600
!
interface TenGigabitEthernet 0/8
 description to DAL-PA-FW02-ETH3
 shutdown
 switchport mode trunk
 switchport trunk allowed vlan only 600
!
interface AggregatePort 1
 description to DAL_SW02
 switchport mode trunk

*** DAL_SW02 ***
interface TenGigabitEthernet 0/7
 description to DAL-PA-FW02-ETH2
 switchport mode trunk
 switchport trunk allowed vlan only 600
!
interface TenGigabitEthernet 0/8
 description to DAL-PA-FW01-ETH3
 switchport mode trunk
 switchport trunk allowed vlan only 600
DAL_SW02#show running-config int ag1  
!
interface AggregatePort 1
 description to DAL_SW01
 switchport mode trunk

**** PA-440 ****
ethernet1/2 {
  layer2 {
    lldp {
      profile ETH2-LLDP-PROFILE;
      enable yes;
    }
    units {
      ethernet1/2.600 {
        tag 600;
      }
      ethernet1/2.1 {
        tag 1;
      }
    }
  }
  lacp {
    port-priority 32768;
  }
  comment "to DAL_SW01 (Eth7)";
}

ethernet1/3 {
  layer2 {
    lldp {
      enable no;
    }
    units {
      ethernet1/3.600 {
        tag 600;
      }
      ethernet1/3.1 {
        tag 1;
      }
    }
  }
  comment "to DAL_SW02 (Eth8)";
}

Text Text Text Text

10
  • Your diagrams are not visible.
    – Ron Trunk
    Jan 18 at 20:30
  • You have not deliberately defined a root bridge?? They're all at 32768. Also, please add the relevant port configurations as text (using the editor's {} preformat function) to your question - switches and PAs. We cannot simply guess what went wrong.
    – Zac67
    Jan 18 at 20:50
  • Wait. Eth{6,7,8} are firewall interfaces, directly between firewalls? So no switch is involved. If there's an issue, it's with the firewalls themselves, as those interfaces never touch a switch.
    – Ricky
    Jan 18 at 21:25
  • @Ricky Ports 6,7,8 on the PA-440s are HA interfaces (As described in diagram) they are not relevant to the issue.
    – James
    Jan 18 at 21:32
  • @Zac67 - I updated the text on the post. The subinterface Vlan1 was used as a troubleshooting attempt to try and match the BPDU vlan. That link I posted as well explains the issue pretty well and people seem to have mixed results with how to resolve it.
    – James
    Jan 18 at 21:51

1 Answer 1

1

Your are trunking VLANs 1 and 600 across the Palo Altos on the bridged ports ethernet1/2 and ethernet1/3. However, the PAs are apparently not taking part in the RSTP. If we assume they're not forwarding BPDUs from the 5860s (in conformance to IEEE 802.1Q) then there's the loop.

You can check whether BPDUs run across the PAs by checking the BPDU counters on the 5680s (something along show spanning-tree statistics). Cheap/simple switches often forward BPDUs regardlessly but any decent gear should filter them.

Without BPDUs running between ports, the 5860s cannot recognize the redundant link and they cannot block forwarding.

IEEE BPDUs are quite different from Cisco PVST BPDUs that run inside VLANs (=they're tagged on trunks) and are forwarded by most non-Cisco devices.

Either you break the bridge on the PAs (use L3 ports instead of L2 ones) or you need to make them run RSTP (no idea if they can).

3
  • The Palos dont participate in STP but they are supposed to forward the BPDUs. Everything you said is I agree with. But I knew this before making the post. I am looking for someone more expert in Palo or has ran this type of topology before and encountered this issue with Palos.
    – James
    Jan 19 at 1:47
  • If it affects your thought process at all. I did setup this identical topology using Cisco Nexus switches (there is a vPC peer-link but no vPC port channels), the switches do BLK the port. Other then the hardware vendor brand, the clear difference between the FS switches and Cisco is the Cisco setup is running PVSTP+ while FS has STP,RSTP,MST.
    – James
    Jan 19 at 4:09
  • [the PAs] are supposed to forward the BPDUs is just an assumption on your part and it wouldn't conform to IEEE. Have you checked? I've added that aspect to the answer. RPVST+ may behave quite differently as BPDUs are sent within trunked VLANs and are not supposed to be filtered by the PAs, also according to IEEE 802.1Q which says nothing about PVST.
    – Zac67
    Jan 19 at 6:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.