topic Re: Configuration Sync is not happening on HA,Server error : Failed to synchronize running configura in General Topics

Configuration Sync is not happening on HA,Server error : Failed to synchronize running configuration

NijithPN — Tue, 14 Apr 2020 14:42:03 GMT

Running configuration sync is not happening between HA peers(PA-5050). We tried manually from Passive firewall CLI by the command request high-availability sync-to-remote running-config but I are getting the error Server error: Failed to synchronize running configuration with HA peer; operation not allowed: URL Database mismatch.

I have restarted the management plane in passive but the result is same.

and the pandb are in same version by

Show system Info for checking url db on both firewalls.

url-db: paloaltonetworks
URL-filtering-version:20200414.20165

Re: Configuration Sync is not happening on HA,Server error : Failed to synchronize running configura

reaper — Wed, 15 Apr 2020 05:28:30 GMT

Have you tried running this on both members:

request url-filtering install pandb-database

Re: Configuration Sync is not happening on HA,Server error : Failed to synchronize running configura

NijithPN — Thu, 16 Apr 2020 11:57:10 GMT

It is not working in 8.1.11 .I think this command is for PAN 9 version.

Re: Configuration Sync is not happening on HA,Server error : Failed to synchronize running configura

kiwi — Thu, 16 Apr 2020 12:16:39 GMT

Hi @NijithPN ,

This command is available in 7.1 PAN-OS also .... I'm sure it's available in PAN-OS 8 as well.

admin@Lab80-80-PA-2050> request url-filtering install > database Install uploaded BrightCloud database > pandb-database Install uploaded Pan DB database > signed-database Install signed uploaded BrightCloud database

Please add more info ... are you getting any output when executing this cmd ?

Cheers,

-Kiwi.

Re: Configuration Sync is not happening on HA,Server error : Failed to synchronize running configura

reaper — Thu, 16 Apr 2020 12:22:04 GMT

"it is not working" doesn't really help much...

What is not working? Are you getting a specific message, is the cli throwing an error?

This command had been around for a while so if it's not working it would be useful to include any output you're seeing so we can help you

Re: Configuration Sync is not happening on HA,Server error : Failed to synchronize running configura

NijithPN — Thu, 16 Apr 2020 13:43:40 GMT

by using the command request url-filtering install pandb-database iam getting this error

Server error : Image has not been uploaded. Upload and try again

Re: Configuration Sync is not happening on HA,Server error : Failed to synchronize running configura

kiwi — Thu, 16 Apr 2020 14:17:23 GMT

Hi @NijithPN ,

Looks like the image isn't downloaded...

Have you tried downloading it (again) ? Note that the passive device might not have the connectivity in order to download.

> request url-filtering download paloaltonetworks region <region-name>

Could you check the output on both devices :

admin@PA-VM> show url-cloud status

Cheers,

-Kiwi.

Re: Configuration Sync is not happening on HA,Server error : Failed to synchronize running configuration

SaurabhB — Mon, 01 Jan 2024 14:19:48 GMT

I am using PA-460 in HA mode and am also getting the same error while trying to download the PAD-DB database. Also pandb is showing not connected. I have checked and nothing looks to be blocked. This error is on Standby Firewalls. My Active firewalls looks good.

>request url-filtering install pandb-database

Server error : Image has not been uploaded. Upload and try again

> show url-cloud status

PAN-DB URL Filtering
License : valid
libcurl resolver : threaded
Cloud connection : not connected
URL database version - device : 0000.00.00.000
URL protocol version - device : pan/0.0.2

Re: Configuration Sync is not happening on HA,Server error : Failed to synchronize running configuration

SDBIT-Andrea — Wed, 29 May 2024 14:47:03 GMT

Hi SaurabhB,
I have the same issues with a couple of paloalto pa-440 on HA active-passive.
Active firewall can updated PanDb without issues, passive firewall no.

My software version is 10.2.8-h3

do you have solved this problem?

Thank you again for your help

Re: Configuration Sync is not happening on HA,Server error : Failed to synchronize running configuration

SaurabhB — Thu, 30 May 2024 12:01:52 GMT

Hi SDBIT-Andrea

There is no resolution till now. show url-cloud status command still throws the same error - Cloud connection : not connected

request url-filtering install pandb-database command shows -

Server error : Image has not been uploaded. Upload and try again

Re: Configuration Sync is not happening on HA,Server error : Failed to synchronize running configuration

LMaxinoiu — Mon, 29 Jul 2024 08:56:00 GMT

Hi Everyone,

A passive device will always be NOT connected to the PAN DB URL cloud.

"Is the firewall in an HA configuration? Verify that the HA state of the firewalls is in the active, active-primary, or active-secondary state. Access to the PAN-DB cloud will be blocked if the firewall is in a different state. Run the following command on each firewall in the pair to see the state:"

There are 2 situations here:

1.If the passive firewall was at some point active, it will have a pandb url version installed (older but still has one)

2.If the passive firewall was never active it will show

show url-cloud status
PAN-DB URL Filtering
License : valid
Cloud connection : not connected
URL database version - device : 0000.00.00.000
URL protocol version - device : pan/0.0.2

If you are meeting scenario 1, a failover will make the firewall try and contact pan db url cloud and get the latest version (if no configuration change that affects whatever interface the firewall is using for contacting pan-db-url cloud

If you are meeting scenario 2, the same applies but with 1 caveat. If you have a security policy blocking "not-resolved" category on top of the security policies above a rule that allows mgmt/data plane interface that is used for this communication you will create an outage.

Follow this recommendation:

"To help ensure connectivity to PAN-DB cloud, create a dedicated Security policy rule that allows all Palo Alto Management Service traffic. This will avoid management traffic from being classified as

not-resolved

and prevent the traffic from being blocked when routed through the dataplane."

My first post here so hope this was useful.

Have a great day.