PA-VM sysd_construct_sync_importer

[Gabeeh]

We got a customer that runs into this issue recently, it's a known issue (not public) for versions 11.0.0, 10.2.3, 10.2.2-h1 (and also to us 10.2.3-h2, 10.2.2-2).

When you run into this, means that there's a hardware issue, please go to TAC in order to find the root cause.

VM-series fails to boot on Hyper V with older Intel Xeon CPUs.

This is happening with Hyper V.

The solutions that we used to fix it are two:

1. Revert to the previous version in maintenance mode:
   1. Enter maintenance mode
   2. Disk image
   3. Revert to the previous
2. Deactivate the Vm and deploy a new one, in this case they use credits VM:
   1. Deactivate the VM license: Deactivate License (Software NGFW Credits) (paloaltonetworks.com)
   2. Deploy a new one.

I post this since it happened to me twice and couldn't find more info, or more relevant info regarding it.

Best wishes!

[kiwi]

Hi @Gabeeh ,

Thanks for sharing this experience with the world ! I'm sure it'll be very useful for whoever runs into the same issue !

Kind regards,

-Kiwi

[JeffH-SecBBQ]

Hello,

I am running into the same issue with the PAN-OS VM-Series Base Image for PAN-OS 11.0.

It may very well be that this issue is related to the CPU(s) powering the hypervisor and not that the issue is specific to Hyper-V.

In my case, the CPU is indeed an older Intel Xeon processor, but I am running on VMware ESXi - not Microsoft Hyper-V.

VMware ESXi 6.7.0 Update 2 (Build 13981272)

ProLiant DL360 G7

12 CPUs x Intel(R) Xeon(R) CPU E5649 @ 2.53GHz

 @Gabeeh  I tried following your recommendation. I booted the VM into the maint partition and tried performing a factory reset. This is a net-new VM-Series build.

I've also tried upgrading an existing VM-Series running 10.2 to version 11.0 and get the same error message as soon as I try to login as user 'admin' from the console.

I've included a copy of the log from VMware ESXi in the event it can provide anything useful in support of the known issue.

The network interface seems to have initialized and I can ping it, but neither SSH nor HTTP/HTTPS are listening, so I am unable to login via the network.

Do you happen to know if this is an issue that will be resolved? Or will the older CPU simply no longer be supported?

Thanks in advance!

[efurlan]

Hi all,

we had the same problem 3 time with a Panorama Management only, the enviroment is Vmware enviroment with 128Gb RAM

I think is a memory leak 

[JeffH-SecBBQ]

Memory leaks typically happen over a period of time. This issue occurs as soon as PAN-OS starts.

The original post, as well as mine, have the older Xeon CPU in common. What hardware are you running on?

I'd think if this were a memory leak, it would be something that would affect many more customers. But just purely speculative.

It would be nice to get some additional feedback from Palo Alto Networks.I think they've been tracking this as an issue but I'm not sure if it's been resolved yet - or if it will be. If it's related to CPU architecture, it may have been a conscious decision to not support aging hardware.

[PavelK]

Today, PAN-OS 10.2.4 and 11.0.1 were released and this issue is addressed in these versions:

PAN-206069
Fixed an issue where the firewall was unable to boot up on older Intel CPUs.

Kind Regards
Pavel