PA-5220 Version: 10.2.5 - Unable to commit after adding a VIP

R.Smith — Wed, 06 Mar 2024 15:41:41 GMT

After creating the sub interface ae1.1416 and using the address 10.149.124.98/27, we are receiving the error below after adding the first usable address as the VIP with 10.149.124.97
Both palos are in an active/active pair

- We are able make the commit without using the VIP

- We can use another IP address in the subnet range as the VIP and commits are successful
- Firewall has been rebooted
- Completely removed the Sub interface/VIP, committed successful, then readded the sub interface/VIP and the commit fails
- This occurs on both primary and secondary firewalls

Details

Partial changes to commit: changes to configuration by administrators:
Changes to configuration in device and network
Error: mprelay : phase1 : config push error
Error: response from cfgpush.s1.dp0.comm.cfg-dp: Error unserializing global object
failed to handle CONFIG_UPDATE_START
(Module: device)
client device phase 1 failure
Commit failed

Any suggestions on what could be causing this issue?

Re: PA-5220 Version: 10.2.5 - Unable to commit after adding a VIP

BPry — Wed, 06 Mar 2024 22:52:52 GMT

@R.Smith,

The error generally relates to a memory allocation problem, but that doesn't really line up with simply adding a VIP pushing you over that line. I'd run 'debug dataplane show cfg-memstat statistics' and see what your VSYS allocation usage is. It's possible that this is pushing you over the edge, but it seems unlikely.

topic Re: PA-5220 Version: 10.2.5 - Unable to commit after adding a VIP in General Topics

PA-5220 Version: 10.2.5 - Unable to commit after adding a VIP

Re: PA-5220 Version: 10.2.5 - Unable to commit after adding a VIP