Auto-commit after upgrade to 10.0.0 fails

[GnContente]

Hi all,

After upgrading a PA-220 from 9.1.13 to 10.0.0 Data plane is not coming up as auto-commit keeps failing. The only info i got so far is as shown:

I have downgraded the PA back to 9.1.13 and the auto commit is successfull after reboot. However when i upgrade back to 10 it fails.

As anyone experience this? How can i troubleshoot this further?

TIA

[reaper]

did you check the commit from CLI? may yield more information (show job id x)

i'd go and install the latest content package (10.0.9) directly from 9.1 so you don't run into early-on bugs, see if that solves your issue

you don't need to install the base 10.0.0, just have it downloaded

[GnContente]

@reaper 

I did, it shows exactly the same "failed to commit policy to the device".  To me it looks like some kind of bug. I am using the Python SDK to upgrade the PA devices and i dont understand why the function "upgrade_to_version" installs the base version as well. 

[JoshuaSanders]

Did you ever resolve this? We are trying to upgrade multiple 220s from 9.1.13 to 10.0.X and it's failing on the auto commit

[JoshuaSanders]

In case anyone else is experiencing the same issue we are having, here is our resolution. We were able to resolve our issue by getting a PA engineer (after escalating with 2 others) with root access to the box and delete the .global-fin file under /opt/pancfg/mgmt/global/ from root shell followed by a management server restart. Still no word on why that was necessary. One of the engineers told us that upgrading our FWs through Panorama is not recommended and that they should only be upgraded through the FW UI itself. We aren't sure why that is being suggested since PA specifically refers to upgrading via Panorama in their documentation and are seeking more information on the case.