topic Re: Firewall shows disconnected from Panorama after upgrade to 10.1.5-h1 in General Topics

Firewall shows disconnected from Panorama after upgrade to 10.1.5-h1

KurtHinson — Wed, 20 Apr 2022 00:12:07 GMT

Just upgraded one of my standby firewalls from 10.1.5 to 10.1.5-h1 for the OpenSSL vulnerability and after the install and reboot it shows disconnected in Panorama (also confirmed via the cli show panorama-status). My Panorama has already been running 10.1.5-h1 for the last week or so with no issues. I have opened a P1 support case but haven't heard anything yet and imagine it will be hours or days so hoping someone here has run into this?

Re: Firewall shows disconnected from Panorama after upgrade to 10.1.5-h1

Remo — Wed, 20 Apr 2022 05:55:09 GMT

Try this:

Generate a new auth key on panorama
Enter this command on the firewall "request sc3 reset"
Restart the management server process with "debug software restart process management-server"
Log in to the firewall again and enter "request authkey set " followed by the auth key you generated on panorama
Enter config mode on the firewall and do a commit force

Re: Firewall shows disconnected from Panorama after upgrade to 10.1.5-h1

KurtHinson — Wed, 20 Apr 2022 13:58:44 GMT

You are amazing! Thank you so much. Support had absolutely no clue how to fix this!

Re: Firewall shows disconnected from Panorama after upgrade to 10.1.5-h1

chrisdenn — Sat, 14 May 2022 11:33:43 GMT

Huge thank you mate! Had the same problem after upgrading to 10.1.5-h2 from 10.0.8. Been fighting for hours with it before I was about to go to TAC but your fix worked perfectly.

Re: Firewall shows disconnected from Panorama after upgrade to 10.1.5-h1

tu.ngo — Tue, 24 May 2022 15:39:31 GMT

Do you have to generate a new auth key on panorama for each FW? This process does not work if the FW Device Groups and Templates is control by PAN.

Re: Firewall shows disconnected from Panorama after upgrade to 10.1.5-h1

BurtAdjoodani — Wed, 24 Aug 2022 21:59:22 GMT

CHECK if Palo-HA pair are no longer connected because of an empty “auth-key”?

Panorama → Managed Devices → Summary

<<Check Certification Column (Should have “pre-defined”) >>

(1) –GENERATE-- OR --COPY-- <panorama-auth-key>

Panorama → Device Registration Auth Key

(2) Use Tools and SSH into Firewall :

(a) Start Stopwatch OR Use “paping” tool

https-tcp-ping “paping -p 443 <ip-address-of firewall>”

(I) type command “request sc3 reset” (this resets it and gets ready for new auth-code)

(II) type command “debug software restart process management-server”

<< MGT WEB GUI & YOUR SSH connection will be KILLED >>

<< Wait 5 -10 Minutes OR watch paping tool >>

(d) SSH BACK into Firewall :

(I) type command “request authkey set <auth-code-from-step(1)>”

(II) Goto Config Mode type command “configure”

<< Wait 2-3 Min for services to be ready for commit >>

(III) type command “commit forced”

<< Check Output for Errors, Once Done Then >>

(IV) type “exit” press <enter>

(V) type “exit” press <enter>

<< Redo Step (2) with the second firewall in the HA Pair >>

(3) Re-Sync Firewall Data after Panorama shows “connected” in

Panorama → Managed Devices → Summary

(a) Push a config ONLY TO SPECIFIC firewalls to re-synced:

(I) Click → Commit → Push to Devices

(II) Click → Edit Selections

(III) Once on scope selection menu UN-CHECK all other Firewalls

(IV) Click “OK”

Re: Firewall shows disconnected from Panorama after upgrade to 10.1.5-h1

edney_noce — Fri, 16 Feb 2024 18:27:33 GMT

I have the same problem after upgrading the firewall from 10.1.12 to 10.2.8. I try the procedures above, but no effect , the firewall still show as disconnected from panorama (v. 10.1.9.

Re: Firewall shows disconnected from Panorama after upgrade to 10.1.5-h1

Moh-Rah — Wed, 15 May 2024 21:25:49 GMT

Edney , Any solution after upgrading one version 10.2.8