Manual upload of PAN OS file fails via GUI with message "Upload file size exceeded system limit"
27286
Created On 11/22/19 06:52 AM - Last Modified 06/29/23 03:45 AM
Symptom
In environments where Palo Alto Networks firewall has no internet connectivity, users can resort to manually upload PAN OS file to firewall using the path "Device>Setup>Software>upload" on GUI. The upload may fail with the message "Upload file size exceeded system limit".
Environment
PANOS 7.1 or older.
Cause
The above symptom can be seen if the "/" (root) partition does not have enough available disk space on a firewall running 7.1.x or older version.
PAN OS 7.1.x or older versions temporarily store the PAN OS file in "/" partition and once the file is completely uploaded then it is transferred to /opt/pancfg as can be seen in the below outputs of "show system disk-space" on a PA 5K running 7.1.x while manually uploading 8.0.0 PAN OS file:
Filesystem Size Used Avail Use% Mounted on
/dev/md2 3.8G 2.5G 1.2G 69% /
/dev/md5 7.6G 1.6G 5.6G 23% /opt/pancfg
Filesystem Size Used Avail Use% Mounted on
/dev/md2 3.8G 2.7G 995M 73% /<<<<<<<<<<<<<<<<<<Use% increases
/dev/md5 7.6G 1.6G 5.6G 23% /opt/pancfg
Filesystem Size Used Avail Use% Mounted on
/dev/md2 3.8G 3.1G 550M 85% /<<<<<<<<<<<<<<<<<<Use% increases
/dev/md5 7.6G 1.6G 5.6G 23% /opt/pancfg
Filesystem Size Used Avail Use% Mounted on
/dev/md2 3.8G 3.3G 363M 91% /<<<<<<<<<<<<<<<<<<upload complete at this stage
/dev/md5 7.6G 1.7G 5.5G 23% /opt/pancfg
After the upload is complete in "/", then file is transferred to /opt/pancfg as can be seen in the below outputs:
Filesystem Size Used Avail Use% Mounted on
/dev/md2 3.8G 3.3G 363M 91% /
/dev/md5 7.6G 2.0G 5.2G 28% /opt/pancfg<<<<<<<<<<<<<<<<<<Use% increases
Filesystem Size Used Avail Use% Mounted on
/dev/md2 3.8G 2.5G 1.2G 69% /<<<<<<<<<<<<<<<<<<Use% decreases to original value
/dev/md5 7.6G 2.4G 4.8G 34% /opt/pancfg<<<<<<<<<<<<<<<<<<file saved at this stage
Resolution
Importing the file from a local scp/tftp server can solve the problem. Using scp/tftp to import the file directly saves the file to /opt/pancfg.
Following commands can be used to import the file using scp/tftp:
scp import software from user@x.x.x.x:/file-path
tftp import software from x.x.x.x file <file-path>
Sample output :
> scp import software from userx@x.x.x.x:/home/userx/Desktop/PanOS_5000-8.0.0
userx@x.x.x.x's password:
PanOS_5000-8.0.0 100% 805MB 33.5MB/s 00:24
PanOS_5000-8.0.0 saved
At the same time no increase in Use% for "/" is seen:
Filesystem Size Used Avail Use% Mounted on
/dev/md2 3.8G 2.5G 1.2G 69% /
/dev/md5 7.6G 1.6G 5.6G 23% /opt/pancfg
Filesystem Size Used Avail Use% Mounted on
/dev/md2 3.8G 2.5G 1.2G 69% /
/dev/md5 7.6G 2.0G 5.3G 27% /opt/pancfg<<<<<<<<<<<<<<<<<<Use% increases
Filesystem Size Used Avail Use% Mounted on
/dev/md2 3.8G 2.5G 1.2G 69% /
/dev/md5 7.6G 2.4G 4.8G 34% /opt/pancfg
Additional Information
Starting from PAN OS 8.0, there has been a change in the behaviour and the manual upload of PAN OS file directly saves the file in /opt/pancfg.