How did commit-all job on branch get the BGP established between hub and branch ,when SD-WAN license expired ?
109
Created On 04/08/26 16:38 PM - Last Modified 07/01/26 20:55 PM
Objective
Primary Cause: Expired SD-WAN License
- SD-WAN licenses expired across all branch sites
- License expiration prevented branches from sending SD-WAN monitoring probes to the hub
Branch Side:
-
- Tunnel connections stuck in UP/path_monitor state
- License check prevented state machine loop execution
- No state transition occurred despite lack of probe activity
Hub Side:
- Tunnel connections marked as DOWN
- No SD-WAN probes received from branches
Environment
Firewalls
Panorama
Procedure
Recovery Mechanism: Why Dummy Push Worked
Workaround : The Configuration Commit from Panorama
>>During commit operations with SD-WAN configuration changes:
// Simplified flow
pan_sdwan_send_updating_notice() // NO license check in this function
└─> Sends ICMP probes over all tunnels
└─> Hub receives probes
└─> Hub marks sdwan tunnel connections as UP
Key Point: pan_sdwan_send_updating_notice() bypasses license validation, allowing probe transmission during commit.
These sites had SaaS SD-WAN connections configured, which triggered:
- SaaS connections as configuration change
- Configuration change detection invoked pan_sdwan_send_updating_notice()
- ICMP probes sent despite expired license
- Hub received probes → sdwan connections restored to UP state
Additional Information
Please refer https://jira-dc.paloaltonetworks.com/browse/PAN-318343 for more information