topic Re: Is my upgrade the cause of a vlan not working in General Topics

Is my upgrade the cause of a vlan not working

jdprovine — Thu, 31 May 2018 15:45:35 GMT

After I upgraded my palo alto fro 7.1.15 to 7.1.16 I had a report that a certain vlan can not longer access the internet. I have a back up of the config before the upgrade and one after the upgrade and so far I don't see any change in virtual routers that would have cause the PA to block the traffic. I know that is very little information but if anyone has any suggestions I would appreciate it

Re: Is my upgrade the cause of a vlan not working

BPry — Thu, 31 May 2018 18:04:20 GMT

@jdprovine,

While it wouldn't be impossible to see an update cause an issue with the configuration that may cause an issue like this, it would be abnormal. Looking at your logs to you see the traffic trying to come across the firewall or can you not even see the traffic?

Re: Is my upgrade the cause of a vlan not working

jdprovine — Thu, 31 May 2018 18:06:18 GMT

@BPry

There is absolutely no traffic from that vlan showing on the firewall at all.

Re: Is my upgrade the cause of a vlan not working

BPry — Thu, 31 May 2018 18:08:47 GMT

@jdprovine,

I'd try to take a PCAP and see if the firewall simply isn't reporting the traffic. Past that I don't think an update would be able to cause this sort of situation short of it somehow managing to 'disable' the port.

Re: Is my upgrade the cause of a vlan not working

jdprovine — Thu, 31 May 2018 18:13:06 GMT

@BPry

I ran a continuous ping to the gateway in the vlan while I ran pcaps with the filter of my pc IP and the gateway IP. The only thing I saw was "no response found"

Re: Is my upgrade the cause of a vlan not working

jdprovine — Fri, 01 Jun 2018 14:21:54 GMT

@BPry

@reaper

the issue ended up being a static route missing from a virtual router, would a firmware update to that?

Re: Is my upgrade the cause of a vlan not working

BPry — Fri, 01 Jun 2018 14:25:31 GMT

@jdprovine,

With a maintenance update this would be the only time I've ever seen or heard about a static route being removed. That isn't to say that it isn't impossible; I've seen routing tables get messed up due to upgrading major versions, but that was years ago and was extremely uncommon then.

I would take a look at your configuration logs and see if another admin didn't clean something up that should have still been there. I wouldn't suspect that the update caused this.

Re: Is my upgrade the cause of a vlan not working

jdprovine — Fri, 01 Jun 2018 14:27:11 GMT

@BPry

I take backup of the config before upgrading and the route that was added to fix the issue did not exist prior to the upgrade

Re: Is my upgrade the cause of a vlan not working

BPry — Fri, 01 Jun 2018 14:37:29 GMT

@jdprovine,

I would guess then that this really wasn't the reason it stopped working; the route was simply what kicked it back into knowing where to send the traffic.

Re: Is my upgrade the cause of a vlan not working

jdprovine — Fri, 01 Jun 2018 14:59:51 GMT

@BPry

My conclusion as well that something before or after the PA changed and the added route let it go where it needed too again