topic Re: Panorama can't proxy web interface after upgrade to 8.1.16 in General Topics

Panorama can't proxy web interface after upgrade to 8.1.16

fjwcash — Wed, 26 Aug 2020 15:43:36 GMT

Upgraded Panorama to 8.1.16. No issues with the upgrade.

Upgraded all our PA-220s to 8.1.16. No issues with the upgrade.

Upgraded our PA-5220s to 8.1.16 (from 8.1.9-h4). If I connect directly to the management IP, I can login to the web interface. If I use Panorama's drop-down list to switch to the firewall, it gives a "createRemoteAppwebSession: response code received 302" error with a "Switch to Panorama" link that takes me back to the Panorama interface.

Pushing commits to the PA-5220s works. And direct logins work. But Panorama links to the firewall web GUIs fails.

Rebooting the Panorama instance doesn't help.

Anyone come across anything similar? Google searches for that error message just bring up captive portal redirect stuff.

Re: Panorama can't proxy web interface after upgrade to 8.1.16

fjwcash — Wed, 26 Aug 2020 20:07:30 GMT

Correction: looks like we can't use the drop-down list for switching to *any* of the firewalls running 8.1.16, from Panorama 8.1.16.

Guess I'll open a support ticket for this. 😞

Edit: Case #01569614 opened.

Re: Panorama can't proxy web interface after upgrade to 8.1.16

Mohammed_Yasin — Sun, 30 Aug 2020 07:16:57 GMT

Me too facing the same issue,

After Firewall Upgrade to 8.1.16, The panorama is neither able to load the firewall-context nor even able to update definitions.

Model 3060

Panorama M-100

Re: Panorama can't proxy web interface after upgrade to 8.1.16

Jernej — Mon, 31 Aug 2020 11:29:46 GMT

We have same problem with:

- panorama virtual appliance

- PA 820

Re: Panorama can't proxy web interface after upgrade to 8.1.16

Arjang999 — Mon, 31 Aug 2020 21:26:41 GMT

same here.

820 and 220, about 10 firewalls!

Re: Panorama can't proxy web interface after upgrade to 8.1.16

fjwcash — Tue, 01 Sep 2020 00:49:53 GMT

Yeah, looks like it's a bug. They're working on it. 😞

Suggested workaround is to downgrade to 8.1.15-h3 if you need to switch context in Panorama.

Re: Panorama can't proxy web interface after upgrade to 8.1.16

Mohammed_Yasin — Thu, 03 Sep 2020 06:27:04 GMT

Hope its bugs.

PAN-93193

Please check and update..

Re: Panorama can't proxy web interface after upgrade to 8.1.16

fjwcash — Thu, 03 Sep 2020 15:22:06 GMT

Hrm, we were given a different bug number: PAN-154181.

Re: Panorama can't proxy web interface after upgrade to 8.1.16

fjwcash — Fri, 11 Sep 2020 18:45:32 GMT

Possibly related to this, Google Chrome 85 is not able to login to Panorama 8.1.16 or 8.1.15-h3 through a NAT connection. Chrome 84 and earlier have no issues logging into Panorama (regardless of version). And, using an SSH tunnel to get to the same subnet as the Panorama server, Chrome 85 is able to login right away.

Fill in username and password, hit login, is shows the "Creating administrative session..." message, then goes to a blank screen with the spinning icon on the tab, and sits there indefinitely. Chrome eventually pops up the "unresponsive page" dialog where you can kill it or wait.

Firefox has no issues logging in through a NAT connection, so I'm leaning toward an issue in Chrome 85. But it only cropped up after upgrading to Panorama 8.1.16, and persisted after downgrading to 8.1.15-h3.

Chrome 85 on Windows or Linux fails to login. Chrome 84 on Windows and Linux logs in fine. Firefox 80 on Windows and Linux login fine.

Re: Panorama can't proxy web interface after upgrade to 8.1.16

dcifer — Mon, 14 Sep 2020 11:18:11 GMT

Same issue. Panorama at 8.1.16 is unable to switch context to target devices running 8.1.16.

It is however able to switch context to firewalls still runing 8.1.15-h3.

Re: Panorama can't proxy web interface after upgrade to 8.1.16

dschoenm — Mon, 14 Sep 2020 12:09:31 GMT

Same here with Panorama PA-100 and 2x2 PA5050 Firewalls, after upgrade to 8.1.16 (coming from 8.1.15).

Re: Panorama can't proxy web interface after upgrade to 8.1.16

RageshD — Wed, 16 Sep 2020 12:06:21 GMT

our VM-300Firewall has the same issue , where Panorama was running on 9.0.9

Firewall on 8.1.16(after upgrade- i too faced the same error for temp i have downgraded the OS version again to 8.1.15-h3 and it working up .

Its has to be bug with version 8.1.16.

Error:CreateRemoteAPPwebsession:Responce code received 302

Re: Panorama can't proxy web interface after upgrade to 8.1.16

fjwcash — Thu, 24 Sep 2020 18:19:25 GMT

The latest update to Chrome 85 has fixed the "Connect through NAT'd connection" issue. Currently using Chrome 85.0.4183.102, and I can login to Panorama again. 🙂

The fix for the "Switch device context" issue is targeted for 8.1.17 sometime in October.

Re: Panorama can't proxy web interface after upgrade to 8.1.16

BatyukhnoE — Tue, 13 Oct 2020 07:48:02 GMT

After downgrade Panorama to 8.1.15 the issue still exists. Connect from Panorama to FW v8.1.16 is not possible.

Re: Panorama can't proxy web interface after upgrade to 8.1.16

fjwcash — Tue, 13 Oct 2020 17:57:48 GMT

Correct. The issue is with PanOS 8.1.16. If the firewalls are running that, Panorama can't switch device context to them. You need to downgrade Panorama and the firewalls to 8.1.15.

Or, 8.1.17 has been released, and they say this has been fixed with that release. We haven't upgraded any firewalls yet to test this.

Re: Panorama can't proxy web interface after upgrade to 8.1.16

Arjang999 — Tue, 13 Oct 2020 18:01:43 GMT

I just upgraded one of my boxes 820, to 8.1.17.

the bug is fixed.

Re: Panorama can't proxy web interface after upgrade to 8.1.16

fjwcash — Tue, 13 Oct 2020 18:06:13 GMT

Thanks for the confirmation! 🙂

Re: Panorama can't proxy web interface after upgrade to 8.1.16

jaszinho — Thu, 05 Nov 2020 08:03:49 GMT

I have upgraded my pano to 8.1.17 but the switching issue still persist.

pano cant load firewalls that are using 8.1.16 version.

Re: Panorama can't proxy web interface after upgrade to 8.1.16

fjwcash — Thu, 05 Nov 2020 16:14:04 GMT

Correct. It's an issue in PanOS and Panorama version 8.1.16.

Both Panorama and the firewalls need to be running 8.1.15 or 8.1.17.