topic Re: Multi-vsys mismatches with peer in General Topics

Multi-vsys mismatches with peer

FabrizioPoggio — Fri, 24 Aug 2018 09:23:33 GMT

Hello guys,

I need to create additional virtual system on a 3020 cluster. Said that I have installed a regular multi-vsys license, I have enabled the multi-vsys capability (Device-Setup-General) on both devices.

Now on both of them the HA state (active-passive) is SUSPENDED with the "multi-vsys mismatches with peer" error.

But apart from enabling the capability I haven't done nothing else.

Any ideas?

The PanOS is 8.0.10.

Thanks!

Re: Multi-vsys mismatches with peer

Remo — Fri, 24 Aug 2018 15:17:10 GMT

Edit: what was written here was useless ...

Re: Multi-vsys mismatches with peer

FabrizioPoggio — Fri, 24 Aug 2018 09:59:44 GMT

Yes, I even tried a "commit force" on both just to be sure

Re: Multi-vsys mismatches with peer

JoeAndreini — Fri, 24 Aug 2018 11:08:46 GMT

Have you tried rebooting or to make them functional from operational commands?

In my experience, when multi-vsys is enabled on an online HA pair this hapens every time - I suspect they suspend themselves due to the mismatch after the first is set to multi-vsys and don't automatically check again after the second is set. Usually manually un-suspending them works for me.

Re: Multi-vsys mismatches with peer

FabrizioPoggio — Fri, 24 Aug 2018 12:05:53 GMT

Thanks Joe! It worked, it was really that simple. Strange behaviour..

Now I have create the new virtual system and associated the interfaces. I have another question..

I wish to use one single phisical interface as the outside interface for any virtual systems. How can I do that? Leave that to the first vsys and then point at that with the virtual routers on the other vsys?

Thank you so much

Re: Multi-vsys mismatches with peer

Remo — Fri, 24 Aug 2018 16:12:55 GMT

@FabrizioPoggio

One vsys needs to be associated with one interface - or subinterface. But what you are actually searching (as I assume) is to use only one interface for all vsys without subinterfaces, right?

In this case, the shared gateway feature could be something for you:

https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/virtual-systems/shared-gateway

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Set-Up-Shared-Gateway-and-Inter-VSYS/ta-p/57370

https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/virtual-systems/configure-a-shared-gateway

Re: Multi-vsys mismatches with peer

FabrizioPoggio — Fri, 24 Aug 2018 16:01:08 GMT

Thank you so much, remo