topic Re: PAN-OS 4.0 error message in General Topics

PAN-OS 4.0 error message

sodi — Thu, 24 Feb 2011 08:41:50 GMT

Hello

Yesterday I've upgraded a PA-2050 from 3.1.7 to 4.0.0.

Now I can't commit the config.

This error message pops up :

Operation	Commit
Status	Failed
Details	shared -> ssl-decrypt is a duplicate node

Frankly I'm a noob in panOS administration.

I feel it is a certificate problem and despite I've found ssl-decrypt word in the xml configuration file, I don't know how to look further.

Help, I need help !

😉

Thanks

Regards

Philippe

Re: PAN-OS 4.0 error message

mharding — Thu, 24 Feb 2011 15:20:52 GMT

I actually got the same error in my Panorama server trying to make a change to the authentication profiles.

Re: PAN-OS 4.0 error message

mharding — Thu, 24 Feb 2011 15:26:42 GMT

Found the problem.

The self-signed cert I use for Panorama management expired in Dec 2010.

Re: PAN-OS 4.0 error message

bpappas — Thu, 24 Feb 2011 15:26:53 GMT

After the upgrade the device will reboot and then perform an auto-commit.

Did the auto-commit succeed? You can check this on the comand line by using the following command:

'show jobs all'

Check the status column for the AutoCommit job. It should show "FIN". If it shows "Pending" or "Failed" then please open a case with Tech Support to determine the root cause of the failure.

Thanks,

Benjamin

Re: PAN-OS 4.0 error message

sodi — Fri, 25 Feb 2011 08:26:14 GMT

It's weird but the AutoCommit job showed "FIN".

I opened case with Tech Support...

Thanks

Re: PAN-OS 4.0 error message

KGC — Tue, 01 Mar 2011 19:13:27 GMT

Does Panorama also do an AutoCommit post-upgrade? After our upgrade I do not see it as one of the jobs. We also can't commit the Panorama config due to a similar error: shared -> ssl-decrypt unexpected here

Re: PAN-OS 4.0 error message

Telenet — Thu, 03 Mar 2011 21:16:29 GMT

For me (and the setup I have); the ssl-decrypt error message comes from the fact that the running configuration is still in 3.x format and not converted to 4.0 format while the candidate config is (the certificate is present in the xml file).

I've exported the candidate config, remove the <ssl-decrypt/> in the <shared> section; imported it back, loaded and commited and it works like a charm (you'll have a reload of the web-ui after an ajax error at 99%)

Hope this helps,

Olivier

Re: PAN-OS 4.0 error message

reaper — Fri, 04 Mar 2011 13:08:45 GMT

A revert to running config should also do the trick

regards