Autocommit loop error and interfaces 'connected but down' after upgrade from 11.0.4-h2 to 11.1.4-h1

[OKelly]

Hi All,

I already posted this in "Discussions > Network Security > Next-Generation Firewall Discussions", but I'm unsure if that is the best place for this issue. 

https://live.paloaltonetworks.com/t5/next-generation-firewall/autocommit-loop-error-and-interfaces-c...

After upgrading my PA-VM VM-100 appliance from from 11.0.4-h2 to 11.1.4-h1 i was met with the following errors:

- Constant failed 'autocommit' jobs spawning, similar to https://live.paloaltonetworks.com/t5/next-generation-firewall/auto-commit-stuck-at-11-0-2-h2-pa-410/.... This prevents any admin action from the Web UI,

- All interfaces were listed as 'connected but down' (grey status for interfaces, and red status for VLAN subinterfaces). The underlying VMXNET3 virtual NICs were definitely connected, and the MGMT interface remained connected.

Due to the above errors, especially the interfaces refusing to come up, I was forced to use 'debug swm status' & 'debug swm revert' to revert to 11.0.4-h2 and reboot, at which point the FW restarted with software version 11.0.4-h2 and all interfaces were once again 'up'.

I'm wondering if anybody has also encountered this issue, or knows of any issues with software version 11.1.4-h1 that would result in this kind of error?

Many thanks!

[OKelly]

After upgrading my PA-VM VM-100 appliance from from 11.0.4-h2 to 11.1.4-h1 i was met with the following errors:

- Constant failed 'autocommit' jobs spawning, similar to https://live.paloaltonetworks.com/t5/next-generation-firewall/auto-commit-stuck-at-11-0-2-h2-pa-410/.... This prevents any admin action from the Web UI,

- All interfaces were listed as 'connected but down' (grey status for interfaces, and red status for VLAN subinterfaces). The underlying VMXNET3 virtual NICs were definitely connected, and the MGMT interface remained connected.

Due to the above errors, especially the interfaces refusing to come up, I was forced to use 'debug swm status' & 'debug swm revert' to revert to 11.0.4-h2 and reboot, at which point the FW restarted with software version 11.0.4-h2 and all interfaces were once again 'up'.

I'm wondering if anybody has also encountered this issue, or knows of any issues with software version 11.1.4-h1 that would result in this kind of error?

Many thanks!

[JayGolf]

Hi @OKelly ,

The only related known issue to autocommit that I've found in 11.1.0: 

PAN-224502

The autocommit time of the VM-Series firewall running PAN-OS 11.1.0 might take longer than expected.

If you need to upgrade to 11.1.4-h1 , I would recommend creating a support case and sharing what you encountered. Thanks for bringing this to everyone's attention. 

[BizBo]

According to what I have been told by PA that the issue is resolved in 11.1.4-h4 but for whatever reason this is not on any public docs. We are planning on trying it. Wish me luck. 

[OKelly]

Thanks BizBo,

Weird that there was nothing official re: this issue, I was going mad thinking I had made an error somehow.

Best of luck, and please let us know if works correctly now.