topic Re: Commit Error After Upgrading to 10.0.9 in General Topics

Commit Error After Upgrading to 10.0.9

SubaMuthuram — Mon, 07 Mar 2022 15:27:11 GMT

Hi Team,

Getting below commit validation error after upgrading to PAN-OS 10.0.9.

Validation Error:
rulebase -> security -> rules -> QUIC_Deny -> hip-profiles unexpected here.

Re: Commit Error After Upgrading to 10.0.9

reaper — Thu, 10 Mar 2022 09:20:27 GMT

you should be able to solve this by opening the rule in GUI, and clicking OK

If you're a little more adventurous you can go into CLI to see what is configured, and delete the set command that is causing the issue

admin@PANgurus(active)> set cli config-output-format set admin@PANgurus(active)> configure Entering configuration mode [edit] admin@PANgurus(active)# show rulebase security | match hip-profile

Re: Commit Error After Upgrading to 10.0.9

SubaMuthuram — Thu, 10 Mar 2022 17:39:58 GMT

Hi Reaper,

Kindly help me how to delete set command ?

Re: Commit Error After Upgrading to 10.0.9

dtran — Thu, 10 Mar 2022 19:43:05 GMT

I am also running into the same issue after upgrading from 9.1.12 to 10.0.9. Open a S1 ticket with PAN support, called in and still waiting on the phone.

Re: Commit Error After Upgrading to 10.0.9

SubaMuthuram — Fri, 11 Mar 2022 01:25:31 GMT

Hi Dtran,

Thanks, please update us if you are getting any resolution for the same.

Re: Commit Error After Upgrading to 10.0.9

TomYoung — Mon, 14 Mar 2022 20:34:53 GMT

Hi @SubaMuthuram ,

It looks like if you remove the HIP profiles from those security policy rules, the commit will succeed. You can do that via GUI or CLI. If you do it by CLI as @reaper suggested, replace the word "set" with "delete" in the command and paste it on the CLI. You can type "commit" on the CLI when done.

Thanks,

Tom

Re: Commit Error After Upgrading to 10.0.9

SubaMuthuram — Fri, 11 Mar 2022 01:52:09 GMT

HI Tom,

actually there is no HIP-Profile attached in the security policy. Please refer the below,

If I just click ok in this policy without changing anything, I am getting below error,

Re: Commit Error After Upgrading to 10.0.9

TomYoung — Fri, 11 Mar 2022 01:56:23 GMT

Hi @SubaMuthuram ,

There may be config lines in the CLI that does not show up in the GUI. Sometimes the upgrade does not convert the config correctly. You can follow @reaper steps to verify.

Thanks,

Tom

Re: Commit Error After Upgrading to 10.0.9

SubaMuthuram — Fri, 11 Mar 2022 02:01:46 GMT

Hi Tom,

Still the same,

Not even committing it, Just gave the set command.

Re: Commit Error After Upgrading to 10.0.9

SubaMuthuram — Fri, 11 Mar 2022 13:10:47 GMT

Hi Dtran,

Did you get any resolution for this ?

Re: Commit Error After Upgrading to 10.0.9

TomYoung — Mon, 14 Mar 2022 20:36:17 GMT

Hi @SubaMuthuram ,

You're so close! Please follow @reaper steps to delete the hip-profile commands and your commit should work. Type in the show command as he specified. Copy the set commands that follow to a clipboard. Replace the 1st "set" with "delete" and paste into the CLI. Type "commit".

Thanks,

Tom

Re: Commit Error After Upgrading to 10.0.9

dtran — Mon, 14 Mar 2022 21:57:59 GMT

I am still waiting for TAC support. PaloAlto support is so bad now that I am actually regretting going with PAN

Re: Commit Error After Upgrading to 10.0.9

SubaMuthuram — Fri, 18 Mar 2022 04:19:18 GMT

Hi @dtran ,

Any update from the TAC team?, Have you got the resolution ?

Re: Commit Error After Upgrading to 10.0.9

SubaMuthuram — Thu, 31 Mar 2022 09:18:22 GMT

Hi Team,

Has anyone have found any resolution for this.

Re: Commit Error After Upgrading to 10.0.9

mprintz — Thu, 31 Mar 2022 18:52:36 GMT

I'm having the same issue after upgrading to 10.1.5 (from 10.1.4-h4). I tried the steps that @reaper posted, but I get an error in the CLI when trying to delete. Guess I'll revert back to 10.1.4-h4 until this is resolved.

user@FW_1(active)# delete rulebase security rules "Allow XYZ" hip-profiles any

Invalid syntax.

***Quick update - the downgrade to 10.1.4-h4 fixed the issue and I was able to commit again without removing the hip-profiles from security rules in the CLI.

Matt

Re: Commit Error After Upgrading to 10.0.9

BillSantoro — Mon, 04 Apr 2022 15:41:20 GMT

I too had the error 'hip-profiles unexpected here' when going from 10.0.8-h8 to 10.0.9 on Panorama. Attempting to run the command 'delete device-group DG_AllFirewalls pre-rulebase security rules "TEST App" hip-profiles', I received 'Invalid syntax.' Even though the steps I list below are for Panorama, you should be able to change them to match your firewall.

Steps I did:
1) Downgrade Panorama from 10.0.9 to 10.0.8-h8
2) Backup your config in case you mess anything up.
3) find all rules that contain hip-profiles with the following commands:

set cli config-output-format set
configure
show device-group DG_AllFirewalls pre-rulebase security | match hip-profiles

4) copy and paste all results in notepad++. then change these commands to be delete commands
5) find and replace "set " with "delete "
6) find and replace "hip-profiles any" with "hip-profiles"
7) copy and paste the updated commands back into putty in sets of 30 (originally I tried sets of 40 but it exceeded the buffer size)
8 ) look for any rules that might have failed or had been missed:

show device-group DG_AllFirewalls pre-rulebase security | match hip-profiles

9) I had one hip-profiles rule that did not delete. The reason neither the delete command, nor the show command matched a rule was because it had 2 consecutive spaces in the name. I'm not sure if it is a bug or a subtle hint to clean up the rule name. I took the hint, cleaned up the rule name from the GUI, and then was able to come back to CLI to delete the hip-profiles entry.
10) commit the changes

commit

11) Optional, exit and set the cli display back to default

exit
set cli config-output-format default

12) take another backup
13) upgrade Panorama from 10.0.8-h8 to 10.0.9
14) test modifying the security rules you were not able to before.

For me, I did the above because I didn't need to plan for any user downtime since the downgrade/upgrade were on Panorama rather than the actual firewalls, and it was only one command to run to remove it. I'm assuming your firewall is in production and it might be annoying to schedule two reboots so I had another idea that I didn't test/use. You should be able to backup/export your config on 10.0.9, remove the hip-profiles lines in the xml file, and then import/load the modified xml file.

I hope that helps.

-Bill

Re: Commit Error After Upgrading to 10.0.9

Sly_Cooper — Tue, 05 Apr 2022 17:55:50 GMT

I am facing a similar issue, however for the Authentication rule. I tried it via CLI. I do see a hip-profile match, however, there is no matching option for the delete command.

delete rules <rule-name> authentication-enforcement Authentication enforcement object to use for authentication. category category description description destination destination destination-hip destination-hip disabled Disable the rule from from group-tag group-tag log-authentication-timeout log-authentication-timeout log-setting Log setting for forwarding authentication logs negate-destination negate-destination negate-source negate-source service service source source source-hip source-hip source-user source-user tag tag target Target devices timeout expiration timer (minutes) to to <Enter> Finish input

Here is config for the policy.

set device-group <GROUP-NAME> post-rulebase authentication rules <RULE NAME> hip-profiles any

Re: Commit Error After Upgrading to 10.0.9

Sly_Cooper — Tue, 05 Apr 2022 18:00:15 GMT

I tried the CLI option. I could see the hip-profile config for the rule, however, delete command does not have hip-profile option for removal. I replace set with delete and use the same config, then it complains about invalid syntax. Looks like a bug.

Re: Commit Error After Upgrading to 10.0.9

santonic — Wed, 06 Apr 2022 10:39:34 GMT

I had this issue in authentication policy where there are luckily not many rules.

List the problematic authentication rule in CLI in set format and you will see a line which sets hip-profile to any.

Unfortunately you can't just use delete command for hip setting as Pan-OS doesn't expect hip-profile here.

So copy the whole existing rule to your favorite text editor, change the rule name to something else, and paste it back without the hip profile line.

After checking the new identical rule is in place, delete the original rule and commit

Re: Commit Error After Upgrading to 10.0.9

Sly_Cooper — Wed, 06 Apr 2022 13:51:44 GMT

One of my colleagues worked on editing the xml config and re-importing the config in Panorama. It resolved the issue. It was a hassle. Palo Alto needs to resolve this issue in the PAN-OS.