topic Re: Standby firewall restarting on 11.0.4-h1 in Next-Generation Firewall Discussions

Standby firewall restarting on 11.0.4-h1

Smithm — Mon, 22 Apr 2024 13:03:23 GMT

Upgraded my 5250 firewall pair last week to 11.0.4-h1 for CVE-2024-3400. Since then, have seen my secondary/standby firewall reboot twice over the course of a week after a error of "HA Group 52: Dataplane is down: too many children exited". This never happened prior to this release.

I am currently working with support, just waiting on a response. Also noticed today that they released 11.0.4-h2.

PAN-252744	(PA-3200 Series, PA-5200 Series, and PA-7000 Series firewalls) Fixed an issue where upgrading the firewall to PAN-OS 11.0.4 or PAN-OS 11.0.4-h1 caused the firewall to go into a non-functional state.

Just curious if anyone else is having these kinds of issues....or did I win the "crash lottery"? Has anyone upgraded to 11.0.4-h2 yet?

Re: Standby firewall restarting on 11.0.4-h1

JayGolf — Wed, 24 Apr 2024 03:11:12 GMT

Hi @Smithm ,

Sorry to read you are experiencing these issues! I hope you can get this resolved soon. Please share any guidance you receive from support.

Re: Standby firewall restarting on 11.0.4-h1

Smithm — Wed, 24 Apr 2024 15:22:51 GMT

Hi Jay,

In working with TAC, we'll be loading 11.0.3-h10 tonight during our maintenance window to see if it helps with the HA2 links crashing. Fingers crossed. 🙂

Re: Standby firewall restarting on 11.0.4-h1

RyanChalmers — Tue, 18 Jun 2024 14:17:38 GMT

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HCcXCAW&lang=en_US%E2%80%A9

The article will explain what is happening, currently experiencing the same issue with version 11.0.4-h2 on PA5220.

Need to Power cycle the device (non-fucntional device) only fix currently available.

Re: Standby firewall restarting on 11.0.4-h1

Satyak — Sun, 07 Jul 2024 16:06:57 GMT

Hey @Smithm

Did the issue resolve after upgrading to 11.0.3-h10 ?.

We are also facing the same issue in 11.0.3-h10.

Thanks and Regads

Satya Kalyan

Re: Standby firewall restarting on 11.0.4-h1

RyanChalmers — Sun, 07 Jul 2024 19:58:17 GMT

So TAC advised us to upgrade to 11.2.0, 11.1.5, or 11.0.7 to fix this issue.

TAC notes the issue you are seeing below > Continuous crashes caused the HA to go to Not-Functional State

"This is the internal known jira PAN-249548 (PA-5220 | Data Plane failure after PAN-OS upgrade) TAC have not published this"

Re: Standby firewall restarting on 11.0.4-h1

Smithm — Mon, 08 Jul 2024 12:06:21 GMT

We went backwards from 11.0.4-h1 to 11.0.3-h10 and it resolved our issue.