topic Re: Post 10.1.3-h1 issues - source-hip unexpected here in General Topics

Post 10.1.3-h1 issues - source-hip unexpected here

SKS7 — Wed, 05 Jan 2022 03:46:06 GMT

Validation Error:
. rulebase -> security -> rules -> *** -> source-hip unexpected here
. rulebase -> security -> rules is invalid
. Commit failed

Do any of you have come across this error post upgrade of Panorama 10.1.3-h1? Not having issues on other firewalls. Current version of the firewall which i am seeing this error is 8.1.15.

Anyone has the solution for this one?

Thank you in advance

Re: Post 10.1.3-h1 issues - source-hip unexpected here

LCMember20111 — Wed, 05 Jan 2022 13:25:36 GMT

You need to upgrade to 8.1.17 or 8.1.18 to get past this. We ran into the same thing and had it tested/vetted before TAC could respond to our ticket.

Re: Post 10.1.3-h1 issues - source-hip unexpected here

SKS7 — Wed, 05 Jan 2022 18:10:47 GMT

Thank you, Will try and check.

Re: Post 10.1.3-h1 issues - source-hip unexpected here

SKS7 — Fri, 07 Jan 2022 15:26:29 GMT

We have not yet upgraded the firewall; Meanwhile Vendor has asked to try "debug software restart process"

Re: Post 10.1.3-h1 issues - source-hip unexpected here

jkim12 — Fri, 07 Jan 2022 18:39:25 GMT

ran into similar with our 8.1 fw's not an issue for 9.0+ fw's restarting the mgmt fixed it

Re: Post 10.1.3-h1 issues - source-hip unexpected here

Eran_Cohen — Sun, 13 Mar 2022 19:33:42 GMT

All our FW's are v9.0.9 and after Panorama upgrade to v10.1.3-h1 we get the same error but only for one GW in HA

Re: Post 10.1.3-h1 issues - source-hip unexpected here

Kamlin_Reddy — Fri, 13 May 2022 18:57:00 GMT

We have had the same issue from 10.1.0 to 10.1.5-h2 on a Panorama pushing config to device and error

Validation Error HIP Profile not expected , and was not using any HIP Profile.

Palo Alto has mentioned this is a common issue and the workaround / fix is upgrade to the version you want and run the following command in the cli

> Configure
> load config from running-config.xml
> commit force

The "commit force" will discard all "hip-profiles unexpected here" in security rules and you can do further changes or Commits.