topic Re: Antivirus Download and Install Hanging in Next-Generation Firewall Discussions

Antivirus Download and Install Hanging

cverniani — Tue, 11 Apr 2023 15:08:31 GMT

Pa11.0.1 onPa820 in High Avaliability mode.

The antivirus download and install update job has been at the "download in progress" status for several hours.

The last antivirus valid is:4406 -4923 of 31/03/2023.

The following resolution answer does not work

Resolution [Not work]

Run the following commands to clear the stuck download job:
> debug software restart device-server [This command does not work]
> debug software restart management-server [This command does not work]

Re: Antivirus Download and Install Hanging

PavelK — Wed, 12 Apr 2023 03:39:58 GMT

Hello @cverniani

could you try these commands instead?

debug software restart process management-server debug software restart process device-server

Kind Regards

Pavel

Re: Antivirus Download and Install Hanging

cverniani — Fri, 14 Apr 2023 07:09:00 GMT

Using the commands you wrote the system accepts:

debug software restart process management-server
debug software restart process device-server

and the system accept ok. [The syntax now is ok]

But the both systems does not complete the new antivirus installing commands.

Both the systems remain at the 59% of the progress.

In the last few days I have updated the system by manually restarting the appliances but new antivirus updates appear every day and it is important that PA can install the updates automatically.

The problem appeared only after updating the PA 820 to version 11.0.1.

Re: Antivirus Download and Install Hanging

mlane — Mon, 24 Jul 2023 18:28:59 GMT

Any other solutions? I am having the same problem with a PA-820 HA pair on 11.0.1-h2. The passive is updating, but the active sticks at 59% for last few days.

Re: Antivirus Download and Install Hanging

cverniani — Tue, 25 Jul 2023 10:52:46 GMT

I have opened a case on PA support and they wrote:

>>PANOS 11 may be prefered for newer firewalls, but with the 820 staying with the prefered 10 version may be better for you until >>Palo recommend to upgrade to 11 for the 820.

[cut]

>>If this does not work, would you consider downgrading the firmware to 10.2.4-h2? This may be the better choice for your 820.

I have downgrade the firmware to 10.2.4-h2.

I solved in this way.

Re: Antivirus Download and Install Hanging

ozheng — Tue, 25 Jul 2023 12:47:32 GMT

That is just a workaround, and fortunately, it seems you did not have strong business requirement to run on PAN-OS 11.0.

Would you mind sharing the case number?

Thank you.

Olivier

Re: Antivirus Download and Install Hanging

mlane — Tue, 25 Jul 2023 13:10:35 GMT

In my case I bought a new pair of PA-1410 firewalls. I upgraded PA-820 to v11 to prepare for config migration from 820 to 1410. I suspended the problematic 820 firewall (failover to passive) and restarted it last night. AV updated.

Re: Antivirus Download and Install Hanging

ozheng — Wed, 26 Jul 2023 03:43:58 GMT

If you have Panorama, you simply move devices in template stack / device group.

(but that is out of scope of this topic)

Re: Antivirus Download and Install Hanging

EquipeRESEAUXLFF — Fri, 22 Sep 2023 15:52:47 GMT

Hello,

I have two PA-220, already 10.2.4-h2 and I have exactly the same issue.

I don't know how to resolve it...

Re: Antivirus Download and Install Hanging

mlane — Fri, 22 Sep 2023 16:31:11 GMT

We are currently working around this issue (until fixed in later version of 11) by disabling telemetry.

Re: Antivirus Download and Install Hanging

stevegreen0 — Mon, 02 Oct 2023 14:41:09 GMT

I have PA-220's running 10.2.5 which fail to install the Antiviris Update.

I have found that Mlane's response above about disabling Telemetry resolves the issue for me (although it still takes time to install).

Re: Antivirus Download and Install Hanging

JavierChueca — Mon, 30 Oct 2023 15:23:41 GMT

Hello:

We are facing similar issue, our use case matches with:
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000004NOKCA2&lang=en_US%E2%80%A9

I hope this helps.

Regards.