duplicate ipsec tunnels

[SergioLopez1]

Hello Comunity,

I have a weird issue, we upgrade a cluster to 10.1.5-h1 from a 9.1 version, after the upgrade on the gui i see all the ipsec tunnels duplicated for example i had an ipsec tunnel called vpn_consult, after the upgrade i had 2 ipsec tunnels called vpn_consult, all the tunnels are working, and in the merge-running-config.xml, i see all the tunnels ok, so, no double entries on the config xml.

someone have see this problem?

[dgarnsey]

Thanks Raido, 10.2.3-h2 fixed it.

[rsaloskar]

I went from 9.1.13 to 10.1.8. i did see this weird behavior when my firewalls were on 10.0.11 along the upgrade path. No actions taken. just upgrade.

[Ivyliao1]

I have the exact same issue.

2 VPN tunnels are pushed from panorama. But the managed firewalls show 4 tunnels -- 2 from panorama and 2 on local firewalls.

However, no VPN configuration can be on the firewalls. And these 4 tunnels are replicated.

[Raido_Rattameister]

Why do you keep firewall operating system on old version and don't upgrade to preferred version?

[Ivyliao1]

Raido,

We can't use PAN-OS v10.2 yet.

Which V10.1 version has the fix as well?

[Raido_Rattameister]

10.1.9 was just released so it is under monitoring.

10.1.8-h2 is preferred.

[Steve_Parish]

Did you find a fix for this?

Running PANOS 10.0.11, but don't want to upgrade to 10.1 as authentication changes

[Raido_Rattameister]

What are you challenges with 10.1 that stop from upgrade?

10.0 is end of life and won't get any updates.

[Steve_Parish]

There are changes to the default behavior between 10.0.x and 10.1 so upgrading one satelliate to 10.1.x isnt an option without changes to the whole estate

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-release-notes/changes-to-default-behavior/chang...

[Raido_Rattameister]

Whoever is running "whole estate" is doing bad job of keeping it on end of life 10.0

Whole environment should be upgraded in this case to be secure.

[Steve_Parish]

Majority of the estate is running 9.1.x which is still in support. Some 850s deployed with 10.0.11

The jump to 10.1.x would cause an issue.

Thanks for looking

[Raido_Rattameister]

Now this makes sense.

I guess you are stuck until estate migrates over.