topic Re: PA3020 upgrade failure from 8.0.11-h1 to 8.1.9-h4 - FIPS failure error in General Topics

PA3020 upgrade failure from 8.0.11-h1 to 8.1.9-h4 - FIPS failure error

Egghead_Systems — Sun, 10 Nov 2019 11:26:49 GMT

We are experiencing an upgrade error/failure when we try to upgrade PA3020 from 8.0.11-h1 to 8.1.9-h4.

When our customer tried to upgrade from 8.0.11-h1 to 8.1.9-h4; their PA3020 went to Maintenance Mode after installing and rebooting .

The Maintenance Mode simply stated that there is a "FIPS failure".

The upgrade steps that we followed are:

a) Download 8.1.0 (base) , without installing

b) Download and Install 8.1.9-h4

After we did step b above the PA3020 rebooted and went straight to maintenance mode with error "FIPS failure"

Luckily, we were able to revert back again to 8.0.11-h1. But , we still need to upgrade to 8.1.x, becuase 8.0.x is already EOL.

We have already contacted palo alto TAC and are now waiting for their reply.

While we are waiting for pan tac reply, has anybody ever experienced a FIPS failure upgrade error like ours? if so, How did you guys resolve the FIPS failure error?

any feedback would be great, thanks

glenn

egghead systems

Re: PA3020 upgrade failure from 8.0.11-h1 to 8.1.9-h4 - FIPS failure error

BPry — Sun, 10 Nov 2019 17:36:23 GMT

@Egghead_Systems,

What was your actual upgrade path. If you followed recommendation you should have installed the latest maintenance release prior to installing 8.1.0 and attempting to boot into your targeted maintenance release.

Also just to point out, 8.1.10 is the preferred release at the moment.

Re: PA3020 upgrade failure from 8.0.11-h1 to 8.1.9-h4 - FIPS failure error

Remo — Sun, 10 Nov 2019 17:36:40 GMT

Hi @Egghead_Systems

When upgrading firewalls - specially the older hardware from paloalto like the 3000 series - you should follow the official recommendation for this. For you this means:

Download and install the latest maintenance release (8.0.20)
Download and install the base image 8.1.0
Download and install the target release. In your case 8.1.9-h4

This way you shouldn't have any problems and to be eveen more sure try a reboot prior to even installing the latest maintenance release as 8.0.11 sounds like your firewall is already running with this quite a while.

Re: PA3020 upgrade failure from 8.0.11-h1 to 8.1.9-h4 - FIPS failure error

Egghead_Systems — Sat, 16 Nov 2019 15:12:52 GMT

@Remo @BPry guys we tried your suggestion for the upgrade path.

we downloaded and installed 8.0.20 and rebooted. successfully upgrade to 8.0.20

downloaded and installed 8.1.0 and rebooted. successfullyupgraded to 8.1.0

downloaded and installed 8.1.10 and rebooted ---> failed to upgrade to 8.1.10 and went to maintenance mode.

we were able to revert back to 8.1.0 and we are now back online with 8.1.0

we have already submitted the tech support file to TAC and waiting for their advice.

in the meantime, do you guys have any idea or experience with this kind of scenario? we are stuck in 8.1.0

Re: PA3020 upgrade failure from 8.0.11-h1 to 8.1.9-h4 - FIPS failure error

MP18 — Sat, 16 Nov 2019 17:39:20 GMT

Let us know what tech finds out?

Re: PA3020 upgrade failure from 8.0.11-h1 to 8.1.9-h4 - FIPS failure error

Remo — Mon, 18 Nov 2019 16:32:18 GMT

Strange situarion. I don't have experience with this szenario, but what I would try in this case is a factory reset of the firewall, re-import the config and then give it another try 😛

Re: PA3020 upgrade failure from 8.0.11-h1 to 8.1.9-h4 - FIPS failure error

MP18 — Mon, 18 Nov 2019 20:53:53 GMT

I like this idea.

Re: PA3020 upgrade failure from 8.0.11-h1 to 8.1.9-h4 - FIPS failure error

OGMaverick — Tue, 19 Nov 2019 13:43:04 GMT

Not sure where you actually see step 2 as the official recommendation. Palo's upgrade articles specifically say to just download a feature release, and then download & install your target release. So for instance from 8.0.11 to 8.1.9 would be:

- Download and install latest 8.0 (8.0.20)

- Download 8.1

- Download & install 8.1.9

" In most cases, the recommended path when moving from one feature release to the next is to download the base image for the next feature release version and then download and install your target maintenance release version. "

https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-new-features/upgrade-to-pan-os-90/upgrade-the-firewall-to-pan-os-90/determine-pan-os-upgrade-path.html

Re: PA3020 upgrade failure from 8.0.11-h1 to 8.1.9-h4 - FIPS failure error

BPry — Wed, 20 Nov 2019 03:17:10 GMT

@OGMaverick,

On older series hardware (200, 500, 3000) the official recommendation was modified so that you download and install the base image with the release of 8.1 specifically due to a number of issues that was being caused on these older platforms due to disk limitations. When you simply download the base image and directly install the target maintenance image the firewall needs to explode both images and build a functional install image from both images.

Newer platforms the increase in size of PAN-OS was properly accounted for and they can handle needing to build that new image. I would still personally recommend installing the base image before installing the maintenance image even on there platforms as you generally have less of an issue with the firewall not properly updating system files and running into update issues.

Re: PA3020 upgrade failure from 8.0.11-h1 to 8.1.9-h4 - FIPS failure error

Egghead_Systems — Fri, 29 Nov 2019 03:07:02 GMT

@MP18 the solution of TAC was to do an RMA. We received a replacement unit of PA3020 with OS of version 7.1.x.

we had to upgrade all the way to 8.1.11

glenn

Re: PA3020 upgrade failure from 8.0.11-h1 to 8.1.9-h4 - FIPS failure error

MP18 — Fri, 29 Nov 2019 06:00:31 GMT

Many Thanks for replying to the post.

Much Appreciated !