topic Re: PANOS 6 and PA2000 series in General Topics

PANOS 6 and PA2000 series

Hithead — Tue, 01 Jul 2014 07:07:35 GMT

we have a really strange issue with PANOS 6 and PA2000 series.

Sometimes, suddenly the PA doesn't react anymore. Serial, MGT and other Ports are not reacting. Strange thing, the Ports are blinking, but no traffic goes through. MGT Mort does only glow at the left LED.

To get the PA running again, a hard restart (power off/on) is required. We are in contact with the support, but I want to ask you, if you have the same behavior at PA2000 series?

Re: PANOS 6 and PA2000 series

HULK — Tue, 01 Jul 2014 07:28:43 GMT

Hello Hithead,

Could you please let us know, which 6.0.X version is running on your PAN firewall..? There was an issue reported for PAN OS version 6.0.1 for a 2000 platform.

You may check below mentioned logs for more insight:

-- mp\devsrv.log

-- mp\ms.log

-- mp\masterd_detail.log

-- SYSTEM logs

Thanks

Re: PANOS 6 and PA2000 series

Hithead — Tue, 01 Jul 2014 07:37:19 GMT

Hi HULK,

we are running 6.0.2 and 6.0.3 on our four PA2000...

I sent every time PaloAlto the TechSupport files. I guess they already analyze the logs?! But I would do that es well...

During the outage, nothing will be written on the System Logs.

Re: PANOS 6 and PA2000 series

HULK — Tue, 01 Jul 2014 07:47:15 GMT

Thanks for sharing the information. (PAN OS 6.0.2 is a very stable release so far). Could you please share your support case ID here.

Thanks

Re: PANOS 6 and PA2000 series

Hithead — Tue, 01 Jul 2014 08:44:58 GMT

- 00217759
- 00220354
- 00218191
- 00229008

Re: PANOS 6 and PA2000 series

pulukas — Tue, 01 Jul 2014 12:07:58 GMT

Just to confirm, the issue only appeared after the upgrade to PanOS 6.

Re: PANOS 6 and PA2000 series

Hithead — Tue, 01 Jul 2014 12:10:18 GMT

correct

Re: PANOS 6 and PA2000 series

Hithead — Tue, 08 Jul 2014 11:06:28 GMT

update: same behavior with 5.0.13

Re: PANOS 6 and PA2000 series

ericgearhart — Tue, 08 Jul 2014 12:48:14 GMT

The PA2000 series is basically an "oops" series from Palo Alto. They won't officially come out and say that, but they don't even want the pair of PA2050s we have sitting in our lab back, it's that bad. You should be yelling at your SE and getting a great deal on a PA3000 if you still have PA2000s.

Re: PANOS 6 and PA2000 series

Hithead — Tue, 08 Jul 2014 12:59:39 GMT

I liked and marked your answer as correct, because that's truth!

We had now several problems with this series and that's a never ending story. In this case, PA recommended to replace the HDD (on all PAs) and complete Hardware (2 of them) - nothing solved the problem.

@all PA2000 series clients: Don't give up!

Re: PANOS 6 and PA2000 series

ericgearhart — Tue, 08 Jul 2014 15:36:17 GMT

I second that, I'm not saying give up either! PA2000s were part of the "first generation" of firewalls PA produced. Any company that puts out a sufficiently revolutionary product is going to have a hard time with their first release... look at the first gen iPhone for an example.

Re: PANOS 6 and PA2000 series

pulukas — Tue, 08 Jul 2014 15:41:42 GMT

Thanks for the updates and troubleshooting. I did suspect this would be a platform issue and not the PanOS version based on the history of the 2000 series.

I hope you can get some back end discounts for an upgrade as a loyal customer.

Re: PANOS 6 and PA2000 series

kknight — Thu, 09 Oct 2014 16:30:46 GMT

see thread Re: PA-2000 Series issues

having the same issues...it is bug in software, so they say, that will be fixed in future release.