UUID and HA - dashboard running config not sync'd with peer

LeeFrancis2 — Fri, 29 May 2020 11:32:52 GMT

We have updated an PA-220 HA pair to 9.0.7 and as expected see Policy Rule UUIDs.

We also manage a separate population of FWs by Panaorama 9.07.

From the release notes for HA deployments:

policy rules sent by Panorama with apply to both HA member firewalls so they have the same UUID
policy rules applied not applied by Panorama with have different UUID on each HA member firewall..

After upgrade this direcly managed firewall dashboard states config not sync'd.

Config audit with peer highlights the different UUIDs. ( along with other HA specific settings )

Given 2 above I would have expected that UUIDs would be excluded form the dashboard status for HA config sync …

Anyone else experience this on update 8.1 > 9.0 ?

Explanations, remedial actions ?

KR,

Lee

Re: UUID and HA - dashboard running config not sync'd with peer

LeeFrancis2 — Fri, 29 May 2020 15:33:39 GMT

After investigating other HA peer discrepencies ( dynamic content schedule and licenses ) syning to peer for active fw resolved the issue. It does seem that the upgrade process had triggered the config not in sync condition, but it does not appear to be specific to PAN-OS 9.0 and the differnet UUIDs.

** Note to PAN TAC documentation team :

please add to

"what setting are dont sync in HA":

Policy - UUIDs.

https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/high-availability/reference-ha-synchronization/what-settings-dont-sync-in-activepassive-ha.html

Lee

topic UUID and HA - dashboard running config not sync'd with peer in General Topics

UUID and HA - dashboard running config not sync'd with peer

Re: UUID and HA - dashboard running config not sync'd with peer