topic Re: Taking longer time to commit on firewall from secondary panorama in General Topics

Taking longer time to commit on firewall from secondary panorama

PankajDhobe — Thu, 18 Mar 2021 14:35:00 GMT

As observed, when primary panorama was active, I have created an Test address object and committed and pushed from panorama. Configuration committed and pushed within 2 to 3 minutes.
After making secondary panorama as an active, configuration was committed after longer time period around 12 to 15 minutes.
As observed on both primary and secondary panorama, there was not any configuration difference between the two.
If anybody is well known about the issue. Please, let me know.

Re: Taking longer time to commit on firewall from secondary panorama

BPry — Thu, 18 Mar 2021 16:26:52 GMT

How far apart was the failover and the attempt to actually push configurations out? Did you attempt to do that shortly after the failover?

Re: Taking longer time to commit on firewall from secondary panorama

PankajDhobe — Fri, 19 Mar 2021 04:34:38 GMT

Configuration commited successfully when secondary was active.

But while pushing configuration to the device group, it was taking longer time. Stuck at 50% for few device group and for some, commit was showing at 0% for 4 to 5 minutes, after that percentage started increasing.

So total duration to push is in between 10 to 15 minutes

But when primary was active configuration was pushed within less time about 2 to 3 minutes.

If it is known issue, please let me share your suggestion.

Re: Taking longer time to commit on firewall from secondary panorama

BPry — Sun, 21 Mar 2021 02:47:39 GMT

@PankajDhobe,

That's certainly not a known issue or expected behavior. It's possible that the system was already running a lot of jobs and simply couldn't queue these as quick as you are used to, but either way if you continue to see this behavior I would log a case with TAC so they can actually review logs. The system should behave exactly the same regardless of which node is active.

Re: Taking longer time to commit on firewall from secondary panorama

nikoolayy1 — Mon, 22 Mar 2021 17:28:00 GMT

Just in case check this article https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm1CCAS and CPU and memory of the secondary panorama before and when you coomit :

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClUbCAK