Palo Alto Interface Down After Reboot: show interface Hardware vs Protocol

Palo Alto · Techclick CLI troubleshooting lab

After a PAN-OS upgrade, ethernet1/3 stays red. The switch port is up. WAN is dead on that link.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

• Name the first CLI command to run on Palo Alto for this ticket

• Separate the layer that is actually broken from the layer people blame

• Apply one scoped fix instead of a global disable

• Prove the ticket closed with a session, log, or counter

Quick answer

Split hardware down from protocol down. Speed/duplex, aggregate membership, and vsys assignment are the usual post-reboot surprises.

Why this ticket shows up

A reboot can lose a forced speed, drop an AE member, or leave the interface in the wrong vsys. The switch still shows link if the SFP is lit.

Symptoms operators actually see

• Interface red in GUI

• Switch shows connected

• AE member missing after reboot

• Transceiver pull shows no Rx power

CLI first — copy this block

Run these on the Palo Alto device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

show interface ethernet1/3
show interface hardware
show lacp aggregate-ethernet ae1
show system state filter-pretty sys.s1.p3.phy
show netstat interface ethernet1/3

How to read that output

Hardware down is cable, SFP, or speed. Protocol down with hardware up is config — vsys, AE, or zone. LACP shows if the member left the bundle.

Triage order

1. show interface and read hardware vs protocol.

2. Check optics power if it is fiber.

3. If it should be in an AE, confirm LACP member state.

4. Match speed/duplex with the switch — prefer auto/auto.

5. Commit is not enough if the transceiver is dead; replace the SFP.

Classic traps

What you see	Real cause	Fix
Replace the firewall	SFP is unseated	Reseat optics first
Force 1G full	Switch is auto	Match both sides
It's a routing issue	Interface is protocol down	Fix L1/L2 first

Proof the ticket is closed

• Interface shows up/up

• Counters increment

• Next-hop ping works

Say this in an interview

I never start with routing on a red interface. Hardware versus protocol tells me which layer is lying.

---

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/