CISCO IE9320 Stack Issue

[Himanshu_Dwivedi]

Hello,

I have 2 IE9320 Switch and configuration in a Stack and Port number Gig1/0/24 and G2/0/24 is connected to Palo Alto Firewall which has LACP confguration and everything is working fine. I am facing weird issue, when I power Off the active Switch member  all the Ports suddenly gets down and change over occurs, but it takes around 30-35 second. 

I have below config on the CIsco Switch port
switchport trunk allowed vlan 4
switchport mode trunk
channel-group 24 mode active
spanning-tree portfast trunk
spanning-tree bpduguard enable
spanning-tree link-type point-to-point
lacp rate fast

[Mark Elsen]

  - @Himanshu_Dwivedi                       Check logs on the leftover switch when that happens, also check networking
                                                            related logs on the Palo Alto

  M.

[pieterh]

>>>  it takes around 30-35 second.  <<<
-> sounds lik a spanning-tree related issue.

>>> spanning-tree bpduguard enable <<<
are you sure you want this on this trunk port ?
could be the port was err-disabled 
-> check logs as @Mark Elsen siggested

[Himanshu_Dwivedi]

I have check the logs, all ports goes physical down and again come back, even SVI are down and UP again.

[Himanshu_Dwivedi]

Palo Alto interface are configured with AE1 interface and under that subinterface was created with VLAN 4 tag, to avoid that port connection to any other switch or bridge I enabled BPDUGUARD, do you suggest to remove this? 

Ports are not in err-disabled state it becomes down and come back again.
Note : Even I disabled STP for VLAN 4 with no spanning-tree vlan 4 command.

[Joseph W. Doherty]

If it's an option, have you configured persistent MAC?

[Himanshu_Dwivedi]

I can see below output

#show switch
Switch/Stack Mac Address : b8c9.242a.4880 -
Local Mac Address Mac persistency wait time: Indefinite

[Joseph W. Doherty]

Okay, that does appear to be a persistent MAC?

Do have any L3 between the stack and FW, especially if running a routing protocol between them?  If so, and if supported, is NSF configured?

BTW, if you're wondering, losing the active stack master can often be more impactful as you've lost the stack's "brain".  Technology like SSO, persistent stack MAC, NSF, etc., either reduce time for a backup stack member to take over running the stack and/or "hide" loss of the active stack master from neighboring network devices while the new stack master is picking up running the stack.

Also, BTW, I've been retired for some years now, and either technology has improved and/or I don't recall all the details.  For example, I vaguely recall NSF devices either fully support the technology, or only basically support it, I.e. a non Cisco FW might not support a NSF neighbor.

Also, although a half minute fail over recovery seems excessive, I recall different platforms can vary much in how quickly they can deal with specific hardware failures (for example dual sup chassis devices might have an edge).

Lastly, sometimes additional configuration statements or modifications to configuration parameters are needed to reduce fail over recovery times.

Your device's manuals, TechNotes and/or White Papers can be very useful achieving high availability.

[Himanshu_Dwivedi]

No Dynamic routing confiugration, I am using only static routes, but the interesting thing, in logs I can see that all the ports and VLANs on switch gets down and comes back immidietely.

[Himanshu_Dwivedi]

I also Degraded the IOS Version but issue still the same. Also I have a stack of Cisco C9300 Stacked switches connected to the same firewall and same type of configuration done at palo alto side, but C9300 failover works very smoothly