Firewall shows disconnected from Panorama after upgrade to 10.1.5-h1

[KurtHinson]

Just upgraded one of my standby firewalls from 10.1.5 to 10.1.5-h1 for the OpenSSL vulnerability and after the install and reboot it shows disconnected in Panorama (also confirmed via the cli show panorama-status).  My Panorama has already been running 10.1.5-h1 for the last week or so with no issues.   I have opened a P1 support case but haven't heard anything yet and imagine it will be hours or days so hoping someone here has run into this?  

[Remo · Accepted solution]

Try this:

1. Generate a new auth key on panorama
2. Enter this command on the firewall "request sc3 reset"
3. Restart the management server process with "debug software restart process management-server"
4. Log in to the firewall again and enter "request authkey set " followed by the auth key you generated on panorama
5. Enter config mode on the firewall and do a commit force

[KurtHinson]

You are amazing!  Thank you so much.  Support had absolutely no clue how to fix this!

[chrisdenn]

Huge thank you mate! Had the same problem after upgrading to 10.1.5-h2 from 10.0.8. Been fighting for hours with it before I was about to go to TAC but your fix worked perfectly. 

[tu.ngo]

Do you have to generate a new auth key on panorama for each FW? This process does not work if the FW Device Groups and Templates is control by PAN.

[BurtAdjoodani]

CHECK if Palo-HA pair are no longer connected because of an empty “auth-key”?

Panorama → Managed Devices → Summary

<<Check Certification Column (Should have “pre-defined”) >>

(1) –GENERATE-- OR --COPY-- <panorama-auth-key>

Panorama → Device Registration Auth Key

(2) Use Tools and SSH into Firewall :

(a) Start Stopwatch OR Use “paping” tool

https-tcp-ping “paping -p 443 <ip-address-of firewall>”

(c) SSH into Firewall2 : (putty, openssh)

(I) type command “request sc3 reset” (this resets it and gets ready for new auth-code)

(II) type command “debug software restart process management-server”

<< MGT WEB GUI & YOUR SSH connection will be KILLED >>

<< Wait 5 -10 Minutes OR watch paping tool >>

(d) SSH BACK into Firewall :

(I) type command “request authkey set <auth-code-from-step(1)>”

(II) Goto Config Mode type command “configure”

<< Wait 2-3 Min for services to be ready for commit >>

(III) type command “commit forced”

<< Check Output for Errors, Once Done Then >>

(IV) type “exit” press <enter>

(V) type “exit” press <enter>

<< Redo Step (2) with the second firewall in the HA Pair >>

(3) Re-Sync Firewall Data after Panorama shows “connected” in

Panorama → Managed Devices → Summary

(a) Push a config ONLY TO SPECIFIC firewalls to re-synced:

(I) Click → Commit → Push to Devices

(II) Click → Edit Selections

(III) Once on scope selection menu UN-CHECK all other Firewalls

(IV) Click “OK”

[edney_noce]

I have the same problem after upgrading the firewall from 10.1.12 to 10.2.8. I try the procedures above, but no effect , the firewall still show as disconnected from panorama (v. 10.1.9. 

[Moh-Rah]

Edney , Any solution after upgrading one version 10.2.8