topic Commit Error after upgrading to 6.1.1 from 6.0.1 in General Topics

Commit Error after upgrading to 6.1.1 from 6.0.1

robertsa — Tue, 06 Jan 2015 16:41:22 GMT

Operation	Commit
Result	Failed

Details vsys1

Error: Duplicate user name 'OU=Students,DC=cadets,DC=cbchs,DC=org'

Error: Failed to parse security policy

(Module: device)

If I revert to 6.0.1 it commits with no issues.

I've tried removing OU=Students,DC=cadets,DC=cbchs,DC=org' from the group include list on the group mapping settings and am still not able to commit after upgrading.

Re: Commit Error after upgrading to 6.1.1 from 6.0.1

Mystique — Tue, 06 Jan 2015 17:01:49 GMT

Hello Robertsa,

Is this HA pair and is the commit failing only on passive device ?

If so, then please make sure root CA certificate is not missing on the passive device. If its missing, then manually reconfigure it and then sync the devices and commit again.

Hope this helps

Re: Commit Error after upgrading to 6.1.1 from 6.0.1

robertsa — Tue, 06 Jan 2015 17:22:04 GMT

Hello Mystique,

This is indeed an HA pair but it is failing on both the passive and active devices.

Thank you,

Robertsa

Re: Commit Error after upgrading to 6.1.1 from 6.0.1

robertsa — Tue, 06 Jan 2015 17:55:16 GMT

Also the CA certificate is present and Status is "Valid" for both devices.

Re: Commit Error after upgrading to 6.1.1 from 6.0.1

Mystique — Tue, 06 Jan 2015 18:03:00 GMT

can you send output of below command from PA FW CLI active or passive device:

> show user group list

Re: Commit Error after upgrading to 6.1.1 from 6.0.1

robertsa — Tue, 06 Jan 2015 18:21:16 GMT

Sure! Message sent

Re: Commit Error after upgrading to 6.1.1 from 6.0.1

Mystique — Tue, 06 Jan 2015 18:28:11 GMT

I can see the whole group name as below from cli command output

cn=all students,ou=groups,ou=students,dc=cadets,dc=cbchs,dc=org

Can you please try to delete the security rule in which this group name is being used and then commit. If commit is successful, then reconfigure the security rule again.

Hope this helps. If not then you might want to open a support case to further troubleshoot the issue live.

Re: Commit Error after upgrading to 6.1.1 from 6.0.1

parmas — Tue, 06 Jan 2015 18:54:50 GMT

Your best bet is just to remove the security policy rule and commit the changes. Then readd it.

Re: Commit Error after upgrading to 6.1.1 from 6.0.1

robertsa — Tue, 06 Jan 2015 19:34:09 GMT

Thanks to you both, Mystique and Parmas,

I had 7 rules applying to just our student users, in each I had users listed: cadets\all students, ou=students,dc=cadets,dc=cbchs,dc=org, and cadets\allstudents.

I first tested the effectiveness of the applicable policies using only ou=students,dc=cadets,dc=cbchs,dc=org, the policies still applied so I attempted upgrading our passive pan with the security policies updated.

The upgrade failed.

So I then tested the effectiveness of the applicable policies using only cadets\allstudents, the policies still applied so I attempted upgrading our passive pan with the security policies updated.

The upgrade was at last successful.

My question is how did you both know to look at security policies and users being listed from the Duplicate user name error? Was vsys1 a clue for you?

Also when the upgrade was failing it was aborting on start up at "satd-config", "sslmgr-config-p1" etc. Why would security rules being ineffective cause start up processes to abort?

Thank you both again,

Robertsa

Re: Commit Error after upgrading to 6.1.1 from 6.0.1

Mystique — Tue, 06 Jan 2015 19:56:57 GMT

This error - Error: Failed to parse security policy was clue for issue being with security policy.

Glad to know upgrade was successful.

Have a great day ahead!!