AWS-VM Panorama cannot push the template to the AWS-VM firewall after upgrade
2764
Created On 07/12/22 00:39 AM - Last Modified 10/09/24 20:00 PM
Symptom
- PAN-OS upgraded on both Panorama and Firewall.
- After upgrade, template push from Panorama to Firewall fails.
- Device config push to the firewall succeeds.
- Task manager of Panorama displays the "Failed" status of jobs.
- The Job status shows "No details" and details can also not be found in the configd log (less mp-log configd.log).
Environment
- AWS-VM Panorama
- AWS-VM Firewall
- Any PAN-OS
Cause
- VM-series plugin on Panorama is lower than the VM-series plugin version on Firewall.
- Enabling the confidg debugging will display the issue.
- After that configd.log shows the committed job 84 was not found in the panorama.
-0500 debug: -0500 debug: pan_get_commitall_job_progress(pan_job_mgr.c:12861): Marking job 84 progress at 0 -0500 debug: pan_jobmgr_print_commitall_job(pan_job_mgr.c:12892): pan_jobmgr_print_commitall_job() -0500 Error: pan_job_refresh_job_cache(pan_job_mgr.c:12766): job 84 not found -0500 Commit All job 84 scheduled -0500 debug: pan_jobmgr_thread(pan_job_mgr.c:4825): Consumer:got a wake_up signal -0500 debug: pan_get_commitall_job_progress(pan_job_mgr.c:12861): Marking job 84 progress at 0 -0500 debug: pan_jobmgr_print_commitall_job(pan_job_mgr.c:12892): pan_jobmgr_print_commitall_job() -0500 debug: pan_jobmgr_thread(pan_job_mgr.c:4823): Consumer:list is empty, waiting for jobs -0500 debug: pan_jobmgr_process_job(pan_job_mgr.c:3514): Job manager will process a job here ...... -0500 Error: pan_commitall_tpl_task_func(pan_ops_cms.c:2395): Plugin version in the device is greater than the version present in tpl config
- In this scenario, the Panorama has: vm_series: vm_series-2.1.5 but The firewall, has vm_series: vm_series-2.1.6
Resolution
- If the Panorama vm-series plugin version is lower than firewall vm-series plugin version, the Panorama can't push the template change to the firewall.
- Upgrade panorama vm_series plugin to be higher or equal to thel vm_series plugin on Firewall.