topic Re: Panorama upgrade to 10.1.3-h in Panorama Discussions

Panorama upgrade to 10.1.3-h

ITISNetwork — Fri, 17 Dec 2021 05:01:30 GMT

Panorama mgmt has been upgraded from 9.1.10 to 10.0.0 and then to 10.1.3-h. Post the upgrade, logs are not showing up in the monitor and not able to commit any changes.

Palo alto firewalls are running with 9.1.6 version; is it a compatibility issue between PAN and firewall. If so what's the best solution. Can we upgrade Palo firewall to 10.0 version or we have to format PAN VM and reconfigure with the backup snapshot?

Re: Panorama upgrade to 10.1.3-h

PavelK — Fri, 17 Dec 2021 05:11:10 GMT

Thank you for the post @ITISNetwork

Based on my experience after Panorama upgrade it can take up to 1 hour to logs be searchable. If you have just finished upgrade, I would wait a bit. This should not be related to any compatibility. As long as Firewall is running lower PAN-OS version than Panorama will work.

Kind Regards

Pavel

Re: Panorama upgrade to 10.1.3-h

ITISNetwork — Fri, 17 Dec 2021 05:25:12 GMT

Thank you Pavel for the reply; that's a great news. However I was referring to one of the article and it says if PAN is running with 10.1 ver then Palo firewall should be running with 10.0 version.

https://live.paloaltonetworks.com/t5/panorama-discussions/panorama-upgrade-to-10-1-3-h/m-p/453829#M575

Also when we are trying to commit the changes; it is showing an error that the address object group is static and not valid

Re: Panorama upgrade to 10.1.3-h

ITISNetwork — Fri, 17 Dec 2021 05:40:18 GMT

I was able to fix the error for commit. However still I don't see traffic logs in the monitor. As you mentioned will wait for few hours to see if it reflects....

Re: Panorama upgrade to 10.1.3-h

PavelK — Fri, 17 Dec 2021 06:00:17 GMT

Thank you for update @ITISNetwork

If logs are still not showing after 1 hours. Could you please check status of ElasticSearch of log collector:

show log-collector-es-cluster health

The status should be green.

Also, could you confirm that log collector is connected and in sync from: Panorama > Managed Collectors?

Kind Regards

Pavel

Re: Panorama upgrade to 10.1.3-h

ITISNetwork — Fri, 17 Dec 2021 16:15:47 GMT

HI Pavel, we are running in panorama mode, we don't have dedicated log collector...and still we don't see any logs

Re: Panorama upgrade to 10.1.3-h

PavelK — Fri, 17 Dec 2021 22:44:26 GMT

Thank you for quick reply @ITISNetwork

As next thing I would be looking into whether all services are running by checking below from Panorama's CLI:

show system software status
show log-collector-es-cluster health

I would also check for any errors in log: tail lines 200 mp-log ms.log as well as under: Monitor > Logs > System.

Have you tried to reboot Panorama?

Kind Regards

Pavel