HA not synchronized after commit from Panorama

[niuk]

I tried it twice, same result every time. I commited change from Panorama to Active firewall and noticed 'Not synchronized' message in Dashboard HA tab. I can't even sync Active with Passive manually. I am using 5060 with 7.1.2 

[BPry]

Simple question but could it be that your passive firewall is down or the link between the two is damaged in some way. If it's not being synchronized and it was prior I would guess that one of those two options was the culperate 

[BPry]

It may also be worth running the two commands listed below and seeing their output.

show high-availability all

show high-availability state

Look at the link state and see if it's reporting that it's actually up, I've had an issue before where the link state was down and it never sent me an alert about it. Still not sure why but once the issue was cleared up I did get an alert stating that the HA peer was up. 

[TranceforLife]

and this command please:

> tail mp-log ha_agent.log

[niuk]

See below:

admin@PFWP01(active)> tail mp-log ha_agent.log
2016-07-05 15:26:10.515 -0400 debug: ha_state_cfg_md5_set(src/ha_state_cfg.c:458): We were out of sync and now we are out of sync; autocommit no; ha-sync no; panorama no; cfg-sync-off no; pre-old-insync no; pre-new-insync no
2016-07-05 15:26:10.516 -0400 Warning: ha_event_log(src/ha_event.c:47): HA Group 1: Commit on peer device with running configuration not synchronized; synchronize manually
2016-07-05 15:26:11.638 -0400 debug: ha_sysd_config_status_notifier_callback(src/ha_sysd.c:2793): Ending monitor increase holdup on commit end
2016-07-05 15:26:11.638 -0400 debug: ha_state_stop_increase_monitor_holdup(src/ha_state.c:1220): Ending monitor holdup increase after commit in 60 seconds
2016-07-05 15:27:29.082 -0400 debug: ha_sysd_config_status_notifier_callback(src/ha_sysd.c:2793): Ending monitor increase holdup on commit end
2016-07-05 15:27:29.082 -0400 debug: ha_state_stop_increase_monitor_holdup(src/ha_state.c:1220): Ending monitor holdup increase after commit in 60 seconds
2016-07-05 15:27:29.082 -0400 Error: ha_state_stop_increase_monitor_holdup(src/ha_state.c:1229): Got into montior holdup increase stop without start
2016-07-05 15:30:41.732 -0400 debug: ha_sysd_config_status_notifier_callback(src/ha_sysd.c:2793): Ending monitor increase holdup on commit end
2016-07-05 15:30:41.732 -0400 debug: ha_state_stop_increase_monitor_holdup(src/ha_state.c:1220): Ending monitor holdup increase after commit in 60 seconds
2016-07-05 15:30:41.732 -0400 Error: ha_state_stop_increase_monitor_holdup(src/ha_state.c:1229): Got into montior holdup increase stop without start
admin@PFWP01(active)>

[niuk]

HA Links are up , sync was fine just before commit from Panorama and is still fine

[TranceforLife]

What did you change in the config. If it is not a big changes please could you try sync manually from Passive > Active (vice versa)

and again post please output of the previous command:

> tail mp-log ms.log

[niuk]

I manusally synced Active with Passive and it worked, see output below. Sync from Passive to Active was not avail, because they are in sync now. 

admin@MR-DC1-PFWP01(active)> tail mp-log ha_agent.log
2016-07-05 18:35:26.225 -0400 debug: ha_state_cfg_check_insync(src/ha_state_cfg.c:269): Group 1: cancel config sync timer
2016-07-05 18:35:29.022 -0400 debug: ha_sysd_mgmt_finsync_notifier_callback(src/ha_sysd.c:2482): Mgmtsrvr sent finsync success
2016-07-05 18:35:29.022 -0400 debug: ha_state_cfg_check_insync(src/ha_state_cfg.c:253): group 1: mgmtsrvr insync: NO; insync2: YES
2016-07-05 18:35:29.022 -0400 debug: ha_state_cfg_check_insync(src/ha_state_cfg.c:269): Group 1: cancel config sync timer
2016-07-05 18:35:29.276 -0400 debug: ha_sysd_mgmt_finsync_notifier_callback(src/ha_sysd.c:2482): Mgmtsrvr sent finsync success
2016-07-05 18:35:29.276 -0400 debug: ha_state_cfg_check_insync(src/ha_state_cfg.c:253): group 1: mgmtsrvr insync: NO; insync2: YES
2016-07-05 18:35:29.276 -0400 debug: ha_state_cfg_check_insync(src/ha_state_cfg.c:269): Group 1: cancel config sync timer
2016-07-05 18:35:29.346 -0400 debug: ha_sysd_config_status_notifier_callback(src/ha_sysd.c:2793): Ending monitor increase holdup on commit end
2016-07-05 18:35:29.346 -0400 debug: ha_state_stop_increase_monitor_holdup(src/ha_state.c:1220): Ending monitor holdup increase after commit in 60 seconds
2016-07-05 18:35:29.346 -0400 Error: ha_state_stop_increase_monitor_holdup(src/ha_state.c:1229): Got into montior holdup increase stop without start
admin@MR-DC1-PFWP01(active)>

[rmonvon · Accepted solution]

Hi...Policies from Panorama must be committed to both active & passive HA devices.  The HA's config sync is for local policies only and does not apply for Panorama shared policies.  One purpose is the admin may commit Panorama changes to the active device  and accidentally lock himself out.  By having the passive remains unaffected, the admin can switch to the passive and correct the issue.  

Thanks.

[kiwi]

What is synced exactly ?

There's a complete list on the following DOC :

https://live.paloaltonetworks.com/t5/Documentation-Articles/High-Availability-Synchronization/ta-p/6...

With regards to Panorama the following settings apply on Active/Passive and Active/Active sync :

What is synced ?

Note that Panorama Policy & Objects and Device and Network Template is not synced so it should be commited from Panorama to all the HA members.