topic Re: Panorama Commit issue 10.1.4-H4 after upgrade from 10.1.3 in Panorama Discussions

Panorama Commit issue 10.1.4-H4 after upgrade from 10.1.3

Pras — Tue, 26 Apr 2022 23:28:07 GMT

Hi guys,

I have a Panorama- 10.1.4-H4 (upgraded from 10.1.3) on AWS and two other firewalls both at 10.0.9 on AWS.

After upgrading, Panorama, I cannot just commit. Throws an error saying plugins unexpected here (for schema verification failed-reverted the config and when trying to commit after that gives the plugin error)

I see below difference in the candidate and running configs when validating (after reverting the config):

I do not see any bugs or any one else facing similar issue.

It looks like a corrupt candidate configuration. But I am afraid if I force commit/force commit it will affect the prod environment specially as it says in the validation process the plugins will be deleted.

Plugin for Panorama: 3.0.2

Plugin for Firewalls: 2.14

@BPry

@SteveCantwell

@reaper

Many Thanks,

Re: Panorama Commit issue 10.1.4-H4 after upgrade from 10.1.3

Pras — Wed, 27 Apr 2022 01:15:58 GMT

Hi Guys,
Any chances you might be knowing the ans?
@BPry
@S.Cantwell

Re: Panorama Commit issue 10.1.4-H4 after upgrade from 10.1.3

S.Cantwell — Wed, 27 Apr 2022 14:16:41 GMT

Howdy

I would think that if your company is not using plugins (please confirm) that you could delete the plugin(s) that are causing your issue.

Re: Panorama Commit issue 10.1.4-H4 after upgrade from 10.1.3

Pras — Thu, 28 Apr 2022 01:56:35 GMT

Hey @S.Cantwell,

Thanks for the reply. Unfortunately, the deployment is in AWS and the plugins are required. What may be the effect if I force commit (As I really think it's a case of a corrupt xml conf file )?

Re: Panorama Commit issue 10.1.4-H4 after upgrade from 10.1.3

S.Cantwell — Thu, 28 Apr 2022 14:49:38 GMT

If you try a commit force and the running config is corrupted, you will still probably get an error and the commit will not be successful.

If you want, export your configuration off, and password protect it. Attach to this thread and then PM directly with the password, then I will download it and try on my Panorama and see if I can figure it out. 😛 Always glad to assist the Community.

Re: Panorama Commit issue 10.1.4-H4 after upgrade from 10.1.3

Pras — Fri, 29 Apr 2022 05:52:55 GMT

Loading running-config and Force Committing just resolved the issue

Re: Panorama Commit issue 10.1.4-H4 after upgrade from 10.1.3

mauri_fortu — Tue, 26 Jul 2022 12:44:05 GMT

Hi guys, happens the same to me on azure.

I tried to revert configuration but not work, could you help me?

Re: Panorama Commit issue 10.1.4-H4 after upgrade from 10.1.3

mauri_fortu — Tue, 26 Jul 2022 14:43:10 GMT

Hi guys,

I just solved by myself the problem.
I mistake to not upgrading the vm_series plugin from 2.0.x to 2.1.x before upgrading the PAN-OS.

So I roolback the panorama to 10.0.11, upgraded the plugin, made a commit, and push the configuration

If the commit doesn't appear, change something, like a description somewhere, and after proceed to commit and push the configuration on the the vm (my case azure one).

For index research my error where

devices -> localhost.localdomain -> template -> azr-ext -> config -> devices -> localhost.localdomain -> deviceconfig -> plugins unexpected here
devices -> localhost.localdomain -> template -> azr-ext -> config -> devices -> localhost.localdomain -> deviceconfig is invalid
devices -> localhost.localdomain -> template-stack -> azr_stack -> config -> devices -> localhost.localdomain -> deviceconfig -> plugins unexpected here
devices -> localhost.localdomain -> template-stack -> azr_stack -> config -> devices -> localhost.localdomain -> deviceconfig is invalid

For both versione xml use the same schema, so I don't know why it says it's unexpected, btw I solved updating before the plugin.

Re: Panorama Commit issue 10.1.4-H4 after upgrade from 10.1.3

renzanjo11 — Fri, 11 Aug 2023 09:26:42 GMT

Hi @Pras ,

Good day! I am very sorry for this question as I am a newbie on Panorama.

I was just curious on what do you mean to load the running config and force committing. Is it on CLI or GUI? May I ask how?

Regards,

Renz

Re: Panorama Commit issue 10.1.4-H4 after upgrade from 10.1.3

Pras — Tue, 15 Aug 2023 23:26:14 GMT

Hey @renzanjo11 ,

I meat loading the saved configuration (GUI) and using the command " Commit Force " from the CLI

p.s: works for Panorama and the FW both.

Re: Panorama Commit issue 10.1.4-H4 after upgrade from 10.1.3

buzor.okoye — Tue, 14 Nov 2023 15:11:36 GMT

This is likely caused by an incompatible vm_series plugins version on Panorama.

I had to upgrade my plugins version to from 2.0.x to 2.1.13 to resolve this.

See vm series plugins compatibility matrix for references https://docs.paloaltonetworks.com/compatibility-matrix/vm-series-firewalls/vm-series-plugin-compatibility

Re: Panorama Commit issue 10.1.4-H4 after upgrade from 10.1.3

Pras — Mon, 27 Nov 2023 22:14:08 GMT

@buzor.okoye That's exactly that had happened. After the plugin update the issue got resolved. Thanks a lot for your feedback.

PS sorry for the delayed response as I was away for a while.