PA-820 Firewalls Won't Come Back up After Upgrade to 8.0.7

[boneelb]

I have two PA-820 firewalls that won't come back up after upgrading to 8.0.7. We have power-cycled to no avail. Support doesn't really have any answers beyond that at this point. We also upgraded an 850 that was fine. Any help?

[BPry]

@boneelb,

Can you get the 820 into maintenance mode? 

[nikoo]

Conect via console and check what's happening there. Or reboot in maint mode and rollback.

[DamianCleveland]

boneelb, were you able to restore the PAs?

[OtakarKlier]

Hello,

I also have a 820 that is misbehaving. Occasionally locks up to the point where there is no traffic passed and no lights on the device. A full power cycle is required. I have a TAC case open and htey think its a memory leak. Not sure why it failed after your reboot however.

Regards,

[boneelb]

Hi all,

Not able to get it into maint mode or restore at this point. Still working with support.

[boneelb]

Haven't been successful yet

[boneelb]

Good to know! We've had green lights all along but nothing passing through / ping timeouts

[boneelb]

After many hours with support, we figured out the problem was actually with our IPSec tunnels and required adding a new security rule - not sure why yet, as only thing we did was upgrade all 3 firewalls to 8.0.7 - guess I missed an important release note! Thanks for all of the help

[sokonta]

Can you please share what policy was added to fix your issue. We currenlt have more than 6 of this, but the two that I have running IPSec tunnel keeps crashing and all the lights in fron disappears and only comes back up on reboot.

Thanks

[boneelb]

Sure - this is the security policy I added to the main firewall that our remote sites tunnel to

Source - x.x.x.x (public IP of firewall on which rule is created)

Destination - x.x.x.x x2 destination address (the public IP addresses of the remote sites - we have two so two here for us)

Service - app default

To be clear, we already had a rule like the two below, but it did not seem to work after upgrading to 8.0.7

Source - Untrust

Destination - Untrust and address: Public IP of main site

Application - ike, ipsec

Service - App default

Please let me know if I can provide further information.