HA broken after upgrading to 6.0.3

[MMCiobanu]

Hi,

We have just upgraded our 5020s and 3020s to 6.0.3 and encountered an issue, where the secondary device became the Active one and the primary displays this error, only on the 5020:

does anybody else had this issue or knows how to solve it?

Thank you.

[LuisLorienteAra]

[Satish]

Hi MMC,

64591 (The fix in this bug resolves two issues: o PA-3000 Series firewalls could stop passing traffic due to errors in the internal datapath. A registry value was changed in the dataplane packet processor to prevent this error. o When highly compressed traffic is passing through PA-7050, PA-5000 Series, or PA-3000 Series firewalls, this caused some additional latency in other traffic passing through the firewall. This fix prevents the latency from being introduced to the traffic by changing the amount of data being handled by the signature matching FPGA.)

Can you try to upgrade one more PAN OS 6.0.3 to PAN OS 6.0.4. i hope its helpful for you. thanks

Regards

Satish

[LuisLorienteAra]

Hi Satish, thank you for your response, I'm reading 6.0.4 release notes and we'll upgrade to 6.0.4 as soon as possible.

thanks again.

[Satish]

Your welcome Luis,

Let me know if you are facing any other challenge.

Regards

Satish

[HULK]

Hello Luis,

For the time being, you may apply the below mentioned command as a workaround:

admin@PA-3020> set system setting packet-path-test enable no

Thanks

[pulukas]

Are you sure that bug id 64591 is what is causing this HA link error message?

Reading the notes and associated ticket reports, there is no mention at all of HA in any of them.

[Satish]

Dear Steven,

How are you dude.., yes cuz one of our client facing same issue after the upgrade  PAN OS issue has been resolve. thanks

Regards

Satish

[LuisLorienteAra]

FAIL

Yesterday we upgraded to 6.0.4 version and the issue arises again.

We followed the next steps:

1) We had two HA nodes in 6.0.2    NodeA  NodeB 5020

2) We suspended the standby NodeB and install 6.0.4 version

3) We did a reboot NodeB to finish instalation

4) NodeB started without problem and it got in standby mode

5) We suspended the primary NodeA so NodeB took control as primary

6) We installed 6.0.4 version in NodeA an we did a reboot to finish

7) When NodeA was starting we got the issue at NodeB "Internal packet path monitoring failure, restarting dataplane"

😎 NodeA was not still ready to take control so we had a network outage of about 2 minutes.

So... if you are experiencing this problem TAKE CARE in migration, in our case the 6.0.4 version doesn't solve the issue.

We are going to open a case.

[HULK]

I would request you to apply below mention CLI commands and let me know the result.

> set system setting packet-path-test enable no

> set system setting packet-descriptor-monitor enable no

Thanks

[HULK]

The above mentioned command should be applied to both the nodes.

Thanks

[LuisLorienteAra]

Ok HULK we will apply the mentioned commands although  we've to look for a downtime window in our production environment so the proof could take a time.

[HULK]

If you could go through the DOC: PAN-OS 5.0.5: Addressed Issues , it looks we are hitting the same BUG-50153 in 6.0.x.

Thanks

[LuisLorienteAra]

Really, it looks like this bug.

[MMCiobanu]

hello,

PAN requested we try to replicate the issue yesterday evening; the guy did apply this command - set system setting packet-path-test enable no - on the node that had issues before and restarted (he did not require restarting both  nodes). The issue did not re-occur, but, this still does not guarantee is not going to in the future.

I don't quite know what this command does, but it looks like you apply it before the reboot, and once the node is up, it is cleared.

Because we were not able to replicate, it is not considered as a solved issue; we are required to call PAN if happening again, so they can collect more information.

Also, yes, I agree, this is the bug we are hitting - BUG-50153, even after upgrading to 6.0.3; we are not going to upgrade to 6.0.4.

Thank you