topic Auto-commit after upgrade to 10.0.0 fails in General Topics

Auto-commit after upgrade to 10.0.0 fails

GnContente — Mon, 07 Mar 2022 20:57:23 GMT

Hi all,

After upgrading a PA-220 from 9.1.13 to 10.0.0 Data plane is not coming up as auto-commit keeps failing. The only info i got so far is as shown:

I have downgraded the PA back to 9.1.13 and the auto commit is successfull after reboot. However when i upgrade back to 10 it fails.

As anyone experience this? How can i troubleshoot this further?

TIA

Re: Auto-commit after upgrade to 10.0.0 fails

reaper — Thu, 10 Mar 2022 09:48:13 GMT

did you check the commit from CLI? may yield more information (show job id x)

i'd go and install the latest content package (10.0.9) directly from 9.1 so you don't run into early-on bugs, see if that solves your issue

you don't need to install the base 10.0.0, just have it downloaded

Re: Auto-commit after upgrade to 10.0.0 fails

GnContente — Fri, 11 Mar 2022 16:17:08 GMT

@reaper

I did, it shows exactly the same "failed to commit policy to the device". To me it looks like some kind of bug. I am using the Python SDK to upgrade the PA devices and i dont understand why the function "upgrade_to_version" installs the base version as well.

Re: Auto-commit after upgrade to 10.0.0 fails

JoshuaSanders — Thu, 30 Jun 2022 02:35:13 GMT

Did you ever resolve this? We are trying to upgrade multiple 220s from 9.1.13 to 10.0.X and it's failing on the auto commit

Re: Auto-commit after upgrade to 10.0.0 fails

JoshuaSanders — Fri, 15 Jul 2022 14:30:24 GMT

In case anyone else is experiencing the same issue we are having, here is our resolution. We were able to resolve our issue by getting a PA engineer (after escalating with 2 others) with root access to the box and delete the .global-fin file under /opt/pancfg/mgmt/global/ from root shell followed by a management server restart. Still no word on why that was necessary. One of the engineers told us that upgrading our FWs through Panorama is not recommended and that they should only be upgraded through the FW UI itself. We aren't sure why that is being suggested since PA specifically refers to upgrading via Panorama in their documentation and are seeking more information on the case.