topic Re: Upgrade to PAN-OS 6.0.4 - a virtual wire did not come up in General Topics

Upgrade to PAN-OS 6.0.4 - a virtual wire did not come up

cstech — Sat, 30 Aug 2014 00:47:58 GMT

Hello,

I have a PAN-OS 6.0.2 box that I upgraded to PAN-OS 6.0.4. I have two vwires: one on interfaces 1/2 and another on 5/6. The vwire on 5/6 did not come up. The interfaces are "up" (green) as far as the web gui is concerned. The "Monitor" shows traffic being "allowed" per the appropriate rules. However, traffic is not flowing.

I have not tried rebooting the device and I don't want to yet... I would like to understand what is broken. Can anyone offer some advice on how to troubleshoot this?

Thank you,

Chris

Re: Upgrade to PAN-OS 6.0.4 - a virtual wire did not come up

hshah — Sat, 30 Aug 2014 00:50:53 GMT

Hi Chris,

How did you determine firewall is dropping traffic if its allowed in Traffic log ?

Can you do packet capture on those interfaces to confirm the same. Also check for dropped packets if there is any.

How to Run a Packet Capture

Regards,

Hardik Shah

Re: Upgrade to PAN-OS 6.0.4 - a virtual wire did not come up

pulukas — Sat, 30 Aug 2014 13:27:48 GMT

I know this is a little extreme, but have you tried another reboot of the system.

I had a situation with a 5k series last year where a power off and on of one of the connected vwire routers caused those same symptoms for the vwire link. no other combination of link bouncing on any of the three devices or reboots helped. We had to reboot the PA to restore the flow.

Re: Upgrade to PAN-OS 6.0.4 - a virtual wire did not come up

cstech — Tue, 02 Sep 2014 06:30:33 GMT

Steven,

Thank you. I will reboot as soon as I can and report back.

Chris

Re: Upgrade to PAN-OS 6.0.4 - a virtual wire did not come up

hshah — Tue, 02 Sep 2014 12:13:21 GMT

Hi Chris,

I would suggest to continue this thread to find root cause of the issue.

Or open a TAC case, if you reboot the device than you will never come to know result.

Regards,

Hardik Shah

Re: Upgrade to PAN-OS 6.0.4 - a virtual wire did not come up

fl1654 — Tue, 02 Sep 2014 17:03:19 GMT

If you have Link Pass Thru enabled on the VWIRE, try disabling to see if the interfaces still show up on the PAN. It should help during trouble-shooting.. Also, make sure STP on the remote ends is setup correctly, and ensure they enable Portfast if not. Might help if you post information on how the remote ports are configured.

--Felix

Re: Upgrade to PAN-OS 6.0.4 - a virtual wire did not come up

cstech — Tue, 02 Sep 2014 18:02:37 GMT

Folks,

Thank you all for your help with this. The vwire came back up some time after after unplugging and re-plugging the cables (I'm sorry I don't know how long after could have been 1 second or 1 day).

FYI the vwire does have "link pass through" enabled.

In summary:

0. Traffic is flowing on vwire (verified with ping)

1. Upgrade PAN-OS from 6.0.2 to 6.0.4

2. PAN reboots as part of the upgrade

3. Ping (and other tests) confirm traffic is not flowing on vwire

4. PAN vwire is bypassed to get the network up

5. vwire is attached to a "test network"

6. I stupidly do not re-run step 3 (it is a remote site and we were all scrambling to get the net back up...)

7. monitor shows traffic is flowing on the vwire

8. I finally get around to re-running step 3 and it shows that the wire is back up

Chris