topic Re: Failed upgrade in General Topics

Failed upgrade

jdprovine — Thu, 25 Jan 2018 20:53:41 GMT

I tried to do an upgrade from 7.1.13 to 7.1.14 and it appeared to install fine, but the ports, all the ports, failed to come up again. So I rolled it back to 7.1.13 and it went back to working fine

Re: Failed upgrade

jdprovine — Thu, 25 Jan 2018 21:41:43 GMT

@BPry @reaper @kiwi

Any thoughts on this upgrade failure?

I tried to do an upgrade from 7.1.13 to 7.1.14 and it appeared to install fine, but the ports, all the ports, failed to come up again. So I rolled it back to 7.1.13 and it went back to working fine

Re: Failed upgrade

OtakarKlier — Thu, 25 Jan 2018 23:15:49 GMT

Hello,

Do you have the PAN's in HA? If yes, when it reboots it fails over to the over to the 'standby' firewall and the one that rebooted will be passive and all ports will be down.

Thoughts?

Re: Failed upgrade

reaper — Fri, 26 Jan 2018 08:35:06 GMT

That would be my first guess as well @OtakarKlier, in an HA cluster the peer on the _lowest_ PAN-OS version gets priority, so that would be one likely scenario

a second scenario could be a 'stuck' autocommit, which is easy to verify:

> show jobs all

> show chassis-ready

Re: Failed upgrade

jdprovine — Fri, 26 Jan 2018 13:26:53 GMT

@reaper @OtakarKlier

I do have an HA pair but I was upgrading the passive firewall first in case I have issues, so there should be no failover because it is the passive firewall. But it should all the port grey out, could not talk to the primary firewall on the heart beat. When I rolled it it back from 7.1.14 to 7.1.13 everything went back to normal. I am including a pic of the firewall after rolling back.

Re: Failed upgrade

jdprovine — Fri, 26 Jan 2018 13:38:04 GMT

@reaper @OtakarKlier

I did see a failed autocommit int he system logs which I also downloaded.

1 1/25/2018 14:13 7801000986 SYSTEM general 0 1/25/2018 14:13 general 0 0 general high Autocommit job failed 440868 0x0 0 0 0 0
1 1/25/2018 14:13 7801000986 SYSTEM sslmgr 0 1/25/2018 14:13 sslmgr-config-p1-abort 0 0 general informational

Re: Failed upgrade

jdprovine — Fri, 26 Jan 2018 17:04:34 GMT

@reaper @Otakar.Klier @BPry

So far I opened a ticket with TAC and uploaded the system logs and they sent me instructions how to upgrade. I know that things can change and processes need to change but in at least 2 years of more that I have been doing the upgrade this way it has always worked