I have identified what seems to be a looping issue, due to STP not blocking an alternate path. As you can see in the diagram, ports Eth7 and Eth8 on the switches connect to the Active/Passive PA-440 pair. Ports Eth2 and Eth3 on the Palo are Layer2 with vlans tagged on sub-interfaces (see picture). When BOTH Eth7 and Eth8 are UP-UP then performance will severely be degraded, i notice drops on the interfaces, drops on ping tests, and traffic bps spikes to 100mpbs+, which this is a non-production setup currently so there is not that much traffic. (Currently using FW02 for troubleshooting) If i shutdown Eth8 on SW01, then performance resumes.
I imagine the BPDU packets are not making it across the Palo interfaces back down towards the switchports.
Similar issue: https://weberblog.net/layer-2-redundancy-with-stp-palo-alto-firewall-cisco-switches/
**** DAL_SW01 ****
interface TenGigabitEthernet 0/7
description to DAL-PA-FW01-ETH2
switchport mode trunk
switchport trunk allowed vlan only 600
!
interface TenGigabitEthernet 0/8
description to DAL-PA-FW02-ETH3
shutdown
switchport mode trunk
switchport trunk allowed vlan only 600
!
interface AggregatePort 1
description to DAL_SW02
switchport mode trunk
*** DAL_SW02 ***
interface TenGigabitEthernet 0/7
description to DAL-PA-FW02-ETH2
switchport mode trunk
switchport trunk allowed vlan only 600
!
interface TenGigabitEthernet 0/8
description to DAL-PA-FW01-ETH3
switchport mode trunk
switchport trunk allowed vlan only 600
DAL_SW02#show running-config int ag1
!
interface AggregatePort 1
description to DAL_SW01
switchport mode trunk
**** PA-440 ****
ethernet1/2 {
layer2 {
lldp {
profile ETH2-LLDP-PROFILE;
enable yes;
}
units {
ethernet1/2.600 {
tag 600;
}
ethernet1/2.1 {
tag 1;
}
}
}
lacp {
port-priority 32768;
}
comment "to DAL_SW01 (Eth7)";
}
ethernet1/3 {
layer2 {
lldp {
enable no;
}
units {
ethernet1/3.600 {
tag 600;
}
ethernet1/3.1 {
tag 1;
}
}
}
comment "to DAL_SW02 (Eth8)";
}
{}
preformat function) to your question - switches and PAs. We cannot simply guess what went wrong.