topic Upgraded our tap mode only PA 4020 from 5.0.5 to 5.0.6 and it "cratered"... we get dataplane restarts every 10 minutes. Anybody else seeing this? in General Topics

Upgraded our tap mode only PA 4020 from 5.0.5 to 5.0.6 and it "cratered"... we get dataplane restarts every 10 minutes. Anybody else seeing this?

ericgearhart — Thu, 25 Jul 2013 19:26:04 GMT

We have a PA4020 that serves as a "canary in the mine" so to speak if you will... we have it only in tap mode, and we feed it various network taps at various points in our network.

Well, having this "canary in the mine" just paid off. I upgraded this box from 5.0.5 to 5.0.6 and we started seeing dataplane restarts every few hours. At support's request and after they'd looked at some core files and tech support dumps, I moved the URL database from BrightCloud to PANDB. After doing so the dataplane literally does not stay up long enough to even boot... the box crapped its pants and booted into maintenance mode on its own.

I downgraded back to 5.0.5 in maintenance mode (made no other changes), and the problem went away again.

Is anyone else seeing this on 5.0.6? If anything else, this should serve as a warning...

Re: Upgraded our tap mode only PA 4020 from 5.0.5 to 5.0.6 and it "cratered"... we get dataplane restarts every 10 minutes. Anybody else seeing this?

kprakash — Thu, 25 Jul 2013 20:48:28 GMT

Good Afternoon Egearhart,

The TAC is investigating this issue. Its unfortunate that the device became unstable after the upgrade. Let me see if I am seeing a similar behavior on one of our lab systems. Was this specific to the 4020, or do you have other firewalls that reported the same issue?

BR,

Karthik

Re: Upgraded our tap mode only PA 4020 from 5.0.5 to 5.0.6 and it "cratered"... we get dataplane restarts every 10 minutes. Anybody else seeing this?

ericgearhart — Thu, 25 Jul 2013 21:11:38 GMT

This is the only firewall that we have in this configuration... what I mean by that is, this is the only firewall that we have in only tap mode, where we're sending it gigs of traffic per day via the taps we have into it (not more than the dataplane can handle, it's just that we don't have any other firewalls in this specific configuration).

I don't mean this in a mean way, but I would hope that you guys (PA I mean) have various models of your Palo Altos in tap mode, basically running different code revisions and you're feeding your corporate office "day to day" Internet traffic through them, just sort of as your own "canaries in the mine" so to speak.

Thanks,

Eric