AWS-VM Panorama cannot push the template to the AWS-VM firewall after upgrade

AWS-VM Panorama cannot push the template to the AWS-VM firewall after upgrade

2764
Created On 07/12/22 00:39 AM - Last Modified 10/09/24 20:00 PM


Symptom


  • PAN-OS upgraded on both Panorama and Firewall.
  • After upgrade, template push from Panorama to Firewall fails.
  • Device config push to the firewall succeeds. 
  • Task manager of Panorama displays the "Failed" status of jobs.
  • The Job status shows "No details" and details can also not be found in the configd log (less mp-log configd.log).

 commit-failure1

 

 
 


Environment


  • AWS-VM Panorama
  • AWS-VM Firewall
  • Any PAN-OS


Cause


  • VM-series plugin on Panorama is lower than the VM-series plugin version on Firewall.
  • Enabling the confidg debugging will display the issue.
  • After that configd.log shows the committed job 84 was not found in the panorama. 
-0500 debug:
-0500 debug: pan_get_commitall_job_progress(pan_job_mgr.c:12861): Marking job 84 progress at 0
-0500 debug: pan_jobmgr_print_commitall_job(pan_job_mgr.c:12892): pan_jobmgr_print_commitall_job()
-0500 Error:  pan_job_refresh_job_cache(pan_job_mgr.c:12766): job 84 not found
-0500 Commit All job 84 scheduled
-0500 debug: pan_jobmgr_thread(pan_job_mgr.c:4825): Consumer:got a wake_up signal
-0500 debug: pan_get_commitall_job_progress(pan_job_mgr.c:12861): Marking job 84 progress at 0
-0500 debug: pan_jobmgr_print_commitall_job(pan_job_mgr.c:12892): pan_jobmgr_print_commitall_job()
-0500 debug: pan_jobmgr_thread(pan_job_mgr.c:4823): Consumer:list is empty, waiting for jobs
-0500 debug: pan_jobmgr_process_job(pan_job_mgr.c:3514): Job manager will process a job here
......
-0500 Error:  pan_commitall_tpl_task_func(pan_ops_cms.c:2395): Plugin version in the device is greater than the version present in tpl config

 

  • In this scenario, the Panorama has: vm_series: vm_series-2.1.5 but The firewall, has vm_series: vm_series-2.1.6


Resolution


  1. If the Panorama vm-series plugin version is lower than firewall vm-series plugin version, the Panorama can't push the template change to the firewall. 
  2. Upgrade panorama vm_series plugin to be higher or equal to thel vm_series plugin on Firewall.


Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000CqT5CAK&lang=en_US&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail

Choose Language