Unable to push configs from Panorama to Managed Firewall or to Prisma Access
7315
Created On 07/01/21 14:25 PM - Last Modified 02/21/24 03:43 AM
Symptom
- Commit from Panorama to Managed Firewalls
- Commit error message "Commit job not queued as platform limit for commit queue was reached" Maximum commit queue length is xx" (xx varies according to platform)
- On Panorama managed Prisma Access error message "Job status query timeouts” message is displayed.
- System logs (show log system) display the same message.
high general general 0 Commit job not queued as platform limit for commit queue was reached.Maximum commit queue length is 10
- On the firewall, CLI command "show jobs all" displays the commit jobs in queue
Enqueued Dequeued ID PositionInQ Type Status Result Completed
-----------------------------------------------------------------------------
2021/06/25 16:04:25 44984 1 Antivirus QUEUED PEND 0%
2021/06/26 03:34:06 44986 2 Content QUEUED PEND 0%
2021/06/24 11:00:05 44972 3 CommitAll QUEUED PEND 0%
.....
Environment
- Panorama managed Firewalls
- PANOS - 9.0 and above
- Panorama managed Prisma Access
Cause
- The number of commit jobs pending is higher than the commit queue length.
- Example, if commit queue length is 10, first 10 commit jobs can be accepted and 11th or later commit jobs will be denied with the above error message.
- Commit queue length varies across firewall models.
Resolution
- Wait for the commit jobs to be completed before sending another commit job.
- If the commit jobs are stuck and not getting cleared, one can use the following method to clear the jobs.
- On the firewall, Restart the management server, device server and check for the pending jobs
> debug software restart process management-server
> debug software restart process device-server
> show jobs all
- On the Panorama restart the config services
> debug software restart process configd
> show jobs all
- Perform another fresh commit-all locally on the firewall initially to check the behavior from the CLI running the command
> configure
# commit force
# exit
- If the commit force from firewall was successful, Try a "commit push" from panorama.
- If the issue is not resolved or if the issue is seen several times, contact Support for assistance.