App and Threat Compatibility MisMatch

[Zewwy]

Hey there,

I have 2 PA-500's currently on:

Software Version	6.0.2
GlobalProtect Agent	1.2.3
Application version	461-2402 (10/14/14)
Threat Version	461-2402 (10/14/14)
Antivirus Version	1391-1863 (10/13/14)
URL Filtering version	4392

Software Version	6.0.2
GlobalProtect Agent	1.2.3
Application version	461-2402 (10/14/14)
Threat Version	461-2402 (10/14/14)
Antivirus Version	1391-1863 (10/13/14)
URL Filtering version	4392

App Version		Mismatch
Threat Version		Mismatch

From what I can tell they are on the same version ( I know my GP version is outdated...)

My question is how come its stating mismatch when they are matched? From this it states to add the passive MAC to the internal/trust interface of the active PA..

Which I don't understand when the ARPing for the Management subnet is handled by a different device in our network design.. (No firewall, just direct routing between the "internal" subnet of the PA and the "management" subnet)

They can ping each other just fine via their separate mgmt IP's, so I don't see what this would accomplish..

Ideas? Thoughts? Suggestions?

[ssharma · Accepted solution]

Hi Zewwy,

It seems either management server is busy on both or one of the pair. They had same version but that informaiton is not able to process for some reason. Can you please run following on both device and paste the output here :

show system resources | match srvr

If you notice number around 1 gig for mgmtsrvr, so ahead and restart management server on both peer.

debug software restart management-server  (this will not impact your production traffic, it will restart the management server process responsible for HA communication)

Hope this helps. Thank you.

[hshah]

Hi Zewwy,

Possibly its happening because of mgmt utilization, however before that I would like to see "show system info" output for both the units.

Quick fix would be to restart management server. you can use command "debug software restart management-serve". It will not impact data plane which actually passes the traffic.

Regards,

Hardik Shah

[Zewwy]

On active plane:

show system resources | match srvr

2762       20   0  261m  94m 9.8m S    0 10.3   1191:01 devsrvr

2763       20   0 1111m  97m 4060 S    0 10.6   1170:49 mgmtsrvr

passive:

show system resources | match srvr
2805       20   0  266m  59m 7552 S    0  6.5   1098:12 devsrvr
2806       20   0  842m 190m 3680 S    0 20.8   1083:52 mgmtsrvr

Thanks so much for the replies so fast too! But looks like both planes aren't over utilitzed, I'll attempt a mgmt reset on both using the supplied restart command and reply the results!

Thanks again!

[ssharma]

Active is running high on management plane as suspected and passive is running high as well.

Please go ahead and restart managmenet server on both device and see if that fixes the issue. Thank you.

[hshah]

Hi Zewwy,

Active box mgmt process is on 1 Gb utilization, which is definitely significant.

Active:

2762       20   0  261m  94m 9.8m S    0 10.3   1191:01 devsrvr

2763       20   0 1111m  97m 4060 S    0 10.6   1170:49 mgmtsrvr >>>>>>>>>>>>>>>>>>1 Gb utilization.

Passive:

2805       20   0  266m  59m 7552 S    0  6.5   1098:12 devsrvr

2806       20   0  842m 190m 3680 S    0 20.8   1083:52 mgmtsrvr >>>>>>>>>>>>>>>>>>Close to 1 Gb

Active passive both are close to 1 Gb, I would also suggest to restart management server.

debug software restart management-serve

Regards,

Hardik Shah

[Zewwy]

Well I reset both, I wasn't sure if there was a specific order, so I restart them pretty much at the same time.. not sure if that was a bad thing...

Cause now I can log into the passive device and it shows the versions as matched, but every-time I attempt to log into the active on either via the internal IP, or direct via its mgmt IP, it jjust replies "Connecting to Management Server failed."

Do I have to reboot its mgmt service again?!?!

[ssharma]

Since active was running high, give it some more time. Traffic should be flowing normally however. Try in another 5 minutes and see if you are able to log in. Thank you.

[hshah]

Hi Zewwy,

I am glad atleast first issue is resolved. Order doesnt matter, but I suggest not to restart management server together on both the units.

Reboot is always a last option. Wait for 10 more minutes, see if it restores on its own.

If it doesnt than restart management server again.That should help.

Regards,

Hardik Shah

[Zewwy]

Thank you both ssharma, and hshah!!

Went for lunch and when I attempted to log in, it worked as you guys described. Thanks again for your prompt replies and suggestions! Much appreciated!