topic Re: HA not synchronized after commit from Panorama in General Topics

HA not synchronized after commit from Panorama

niuk — Tue, 05 Jul 2016 18:50:36 GMT

I tried it twice, same result every time. I commited change from Panorama to Active firewall and noticed 'Not synchronized' message in Dashboard HA tab. I can't even sync Active with Passive manually. I am using 5060 with 7.1.2

Re: HA not synchronized after commit from Panorama

BPry — Tue, 05 Jul 2016 19:20:27 GMT

Simple question but could it be that your passive firewall is down or the link between the two is damaged in some way. If it's not being synchronized and it was prior I would guess that one of those two options was the culperate

Re: HA not synchronized after commit from Panorama

BPry — Tue, 05 Jul 2016 19:24:37 GMT

It may also be worth running the two commands listed below and seeing their output.

show high-availability all

show high-availability state

Look at the link state and see if it's reporting that it's actually up, I've had an issue before where the link state was down and it never sent me an alert about it. Still not sure why but once the issue was cleared up I did get an alert stating that the HA peer was up.

Re: HA not synchronized after commit from Panorama

TranceforLife — Tue, 05 Jul 2016 19:30:53 GMT

and this command please:

> tail mp-log ha_agent.log

Re: HA not synchronized after commit from Panorama

niuk — Tue, 05 Jul 2016 19:34:07 GMT

See below:

admin@PFWP01(active)> tail mp-log ha_agent.log
2016-07-05 15:26:10.515 -0400 debug: ha_state_cfg_md5_set(src/ha_state_cfg.c:458): We were out of sync and now we are out of sync; autocommit no; ha-sync no; panorama no; cfg-sync-off no; pre-old-insync no; pre-new-insync no
2016-07-05 15:26:10.516 -0400 Warning: ha_event_log(src/ha_event.c:47): HA Group 1: Commit on peer device with running configuration not synchronized; synchronize manually
2016-07-05 15:26:11.638 -0400 debug: ha_sysd_config_status_notifier_callback(src/ha_sysd.c:2793): Ending monitor increase holdup on commit end
2016-07-05 15:26:11.638 -0400 debug: ha_state_stop_increase_monitor_holdup(src/ha_state.c:1220): Ending monitor holdup increase after commit in 60 seconds
2016-07-05 15:27:29.082 -0400 debug: ha_sysd_config_status_notifier_callback(src/ha_sysd.c:2793): Ending monitor increase holdup on commit end
2016-07-05 15:27:29.082 -0400 debug: ha_state_stop_increase_monitor_holdup(src/ha_state.c:1220): Ending monitor holdup increase after commit in 60 seconds
2016-07-05 15:27:29.082 -0400 Error: ha_state_stop_increase_monitor_holdup(src/ha_state.c:1229): Got into montior holdup increase stop without start
2016-07-05 15:30:41.732 -0400 debug: ha_sysd_config_status_notifier_callback(src/ha_sysd.c:2793): Ending monitor increase holdup on commit end
2016-07-05 15:30:41.732 -0400 debug: ha_state_stop_increase_monitor_holdup(src/ha_state.c:1220): Ending monitor holdup increase after commit in 60 seconds
2016-07-05 15:30:41.732 -0400 Error: ha_state_stop_increase_monitor_holdup(src/ha_state.c:1229): Got into montior holdup increase stop without start
admin@PFWP01(active)>

Re: HA not synchronized after commit from Panorama

niuk — Tue, 05 Jul 2016 19:35:01 GMT

HA Links are up , sync was fine just before commit from Panorama and is still fine

Re: HA not synchronized after commit from Panorama

TranceforLife — Tue, 05 Jul 2016 19:54:17 GMT

What did you change in the config. If it is not a big changes please could you try sync manually from Passive > Active (vice versa)

and again post please output of the previous command:

> tail mp-log ms.log

Re: HA not synchronized after commit from Panorama

niuk — Tue, 05 Jul 2016 22:38:49 GMT

I manusally synced Active with Passive and it worked, see output below. Sync from Passive to Active was not avail, because they are in sync now.

admin@MR-DC1-PFWP01(active)> tail mp-log ha_agent.log
2016-07-05 18:35:26.225 -0400 debug: ha_state_cfg_check_insync(src/ha_state_cfg.c:269): Group 1: cancel config sync timer
2016-07-05 18:35:29.022 -0400 debug: ha_sysd_mgmt_finsync_notifier_callback(src/ha_sysd.c:2482): Mgmtsrvr sent finsync success
2016-07-05 18:35:29.022 -0400 debug: ha_state_cfg_check_insync(src/ha_state_cfg.c:253): group 1: mgmtsrvr insync: NO; insync2: YES
2016-07-05 18:35:29.022 -0400 debug: ha_state_cfg_check_insync(src/ha_state_cfg.c:269): Group 1: cancel config sync timer
2016-07-05 18:35:29.276 -0400 debug: ha_sysd_mgmt_finsync_notifier_callback(src/ha_sysd.c:2482): Mgmtsrvr sent finsync success
2016-07-05 18:35:29.276 -0400 debug: ha_state_cfg_check_insync(src/ha_state_cfg.c:253): group 1: mgmtsrvr insync: NO; insync2: YES
2016-07-05 18:35:29.276 -0400 debug: ha_state_cfg_check_insync(src/ha_state_cfg.c:269): Group 1: cancel config sync timer
2016-07-05 18:35:29.346 -0400 debug: ha_sysd_config_status_notifier_callback(src/ha_sysd.c:2793): Ending monitor increase holdup on commit end
2016-07-05 18:35:29.346 -0400 debug: ha_state_stop_increase_monitor_holdup(src/ha_state.c:1220): Ending monitor holdup increase after commit in 60 seconds
2016-07-05 18:35:29.346 -0400 Error: ha_state_stop_increase_monitor_holdup(src/ha_state.c:1229): Got into montior holdup increase stop without start
admin@MR-DC1-PFWP01(active)>

Re: HA not synchronized after commit from Panorama

rmonvon — Wed, 06 Jul 2016 00:54:50 GMT

Hi...Policies from Panorama must be committed to both active & passive HA devices. The HA's config sync is for local policies only and does not apply for Panorama shared policies. One purpose is the admin may commit Panorama changes to the active device and accidentally lock himself out. By having the passive remains unaffected, the admin can switch to the passive and correct the issue.

Thanks.

Re: HA not synchronized after commit from Panorama

kiwi — Mon, 11 Jul 2016 08:38:37 GMT

What is synced exactly ?

There's a complete list on the following DOC :

https://live.paloaltonetworks.com/t5/Documentation-Articles/High-Availability-Synchronization/ta-p/61190?attachment-id=1035

With regards to Panorama the following settings apply on Active/Passive and Active/Active sync :

What is synced ?

Note that Panorama Policy & Objects and Device and Network Template is not synced so it should be commited from Panorama to all the HA members.