1

I have RMA'd PA-3020 which is secondary FW02 for one of the office. PA sent this with 6.0.6 OS whereas my primary FW01 is on 5.0.12.

I have configured FW02 via console and later downgraded it to 5.0.12 which went smoothly.

Now I issued HA Config to this FW01 and tried to commit but this stuck after 70%. I did Force Commit as well but that too didn't helped.

Hence I am unable to now rack this new FW02. Can someone please assist me here?

I am on call with PA TAC now and they saw this too for the 1st time. Need expert advise.

Thanks everyone in advance for time.

Rgds Rounak

1
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 12 '17 at 18:11
2

In my experience replacing a device in HA with different PanOS version, I encountered problem exporting config from a device and imparting it to another with different version. There are small differences in the XML between version that make commit process fail.

  • Are you importing and exporting config from a device to another or you are just configuring it one of the devices from a scractch?
  • Are you commiting via console or GUI?
  • Just as curiosity. You are planning a downtime, why not upgrated to last version branch 7.X or at least 6.1.X?
1

EDIT:

PA TAC declared buggy behavior and blamed it on to the OS version. The process to sync a 5.0.12 with 6.0.6 was not recommended. Later post upgrading the standalone box to the latest version (as per the new box) resolved the issue.


ORIGINAL answer

@KorXo: Many thanks. After many hours of conversation with PA TAC:-

  • No 2 different versions can be synced in HA peers. (The member have to match the ver)
  • Yes, The XML files have differences
  • I have configured the management for the 2nd device to be synced & then wanted it to import all the configuration from Primary firewall
  • But the Auto commit was failing for the new device. Via GUI as well as CLI
  • Also due to standard across firm, I am not allowed to switch the FW to 6.x or 7.x OS as of now

Ultimately PA TAC is analyzing the returned box and will provide the reason for auto/force commit failure.

Take home for me was the below URLs which are quite helpful. This may help you as well. Please check.

--How to Factory Reset a Palo Alto Networks Device (use HTTPS:// before all the urls)

live.paloaltonetworks.com/t5/Management-Articles/How-to-Factory-Reset-a-Palo-Alto-Networks-Device/ta-p/56029

--How to SSH into Maintenance Mode

live.paloaltonetworks.com/t5/Management-Articles/How-to-SSH-into-Maintenance-Mode/ta-p/59635

--How to Configure Management Interface from Maintenance Mode

live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-Management-Interface-from-Maintenance-Mode/ta-p/53004

--Setup a RMA Replacement Firewall

live.paloaltonetworks.com/docs/DOC-2134

--Transfer Licenses from RMA Device

live.paloaltonetworks.com/docs/DOC-6278

--Set Up a High Availability Replacement Device

live.paloaltonetworks.com/docs/DOC-6416

6
  • so what actually solved the problem ? – This May 25 '16 at 16:21
  • @Mike: PA TAC declared buggy behavior and blamed it on to the OS version. The process to sync a 5.0.12 with 6.0.6 was not recommended. Later post upgrading the standalone box to the latest version (as per the new box) resolved the issue. Hope this helped you. Feel free to write. Rgds Rounak – Rounak May 26 '16 at 15:41
  • You should accept your answer so that the question doesn't keep popping up and looking for an answer. – Ron Maupin May 26 '16 at 15:59
  • I edited the resolution in, could you accept this answer so the system will stop bumping the question active? – This May 26 '16 at 15:59
  • @MikePennington Thanks and sorry for delayed response. Can you please advise me on how to accept the answer as I do not see any acceptance tab. – Rounak Jul 2 '16 at 5:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.