topic Re: PA-220 Unable to install Panos from 10.0.0 to later version in Next-Generation Firewall Discussions

PA-220 Unable to install Panos from 10.0.0 to later version

Puvi12 — Mon, 25 Mar 2024 10:47:47 GMT

I was trying to upgrade a PA220 from 9.1.X to 10.1.12.

The Plan is to upgrade to 10.0.0(Install &Reboot) --->10.1.0 -->10.1.12(Install & Reboot)

After upgrading to 10.0.0, auto-commit completed and system is up and running without any issue. However, when I try to install 10.1.0 or 10.1.12. getting the below error.

Failed to install 10.1.0 with the following errors:.

SW version is 10.1.0

Traceback (most recent call last):

File "/usr/local/bin/swm", line 18, in <module>

swmmain.main(sys.argv[1:])

File "/usr/share/pan-swm/swmmain.py", line 103, in main

UI.runCommand(H)

File "/usr/share/pan-swm/swmcli.py", line 270, in runCommand

cmd(self.extcmds)

File "/usr/share/pan-swm/swmcli.py", line 410, in do_install

self.install_image(args)

File "/usr/share/pan-swm/swmcli.py", line 484, in install_image

swm.swmDatabase(self).cancel()

File "/usr/lib/python2.7/site-packages/swm/swmdb.py", line 557, in cancel

biosChanged = self.isBiosChanged(img)

File "/usr/lib/python2.7/site-packages/swm/swmdb.py", line 533, in isBiosChanged

if bool(app_flags_p) and ('swm' in app_flags_p.keys()) and ('secureboot' in app_flags_p['swm'].keys()):

AttributeError: 'str' object has no attribute 'keys'

Failed to install version 10.1.0 type pa

I tried to reinstall the 10.0.0, but it also failed with the same error.

Any suggestion or resolution to fix the issue.

#PA-220 #@kiwi @reaper

Re: PA-220 Unable to install Panos from 10.0.0 to later version

kiwi — Mon, 25 Mar 2024 12:33:26 GMT

Hi @Puvi12 ,

I've seen this before where PAN-OS has been installed but the system has not been restarted. Any install attempt fails with an error due to files not being setup as expected for scripts to run successfully.

Try running the following command from CLI : debug swm status

Confirm one of the states returns 'PENDING-CHANGE' and also confirm that the version matches the PAN-OS that the device was being upgraded to.

admin@PA-VM> debug swm status Partition State Version -------------------------------------------------- sysroot0 PENDING-CHANGE 10.2.7-h3 sysroot1 RUNNING-ACTIVE 10.1.12 maint READY 10.2.7-h3

Check the device Task Manager to confirm that the 'Software Install' status is complete and the result is 'Successful'.

If the above is true you can restart the device to apply new PAN-OS version.

Hope this helps,

Kim.

Re: PA-220 Unable to install Panos from 10.0.0 to later version

Puvi12 — Tue, 26 Mar 2024 08:34:51 GMT

Thanks @kiwi for the prompt response. Let me check and confirm it..

Re: PA-220 Unable to install Panos from 10.0.0 to later version

reaper — Tue, 26 Mar 2024 08:37:39 GMT

also, first install the latest maintenance version in the 10.0.0 train (10.0.12) before moving on to 10.1

best practice that helps prevent running into bugs while upgrading