Panorama push errors None after upgrade

[Tom-Lee]

We recently had this issue where after upgrading firewalls to 10.1 the panorama gave a error on push to certain firewalls with description "none" which wasn't very helpful.  On further process eliminating we discovered it was only VM FW's in AWS the error occurred on.  Panorama wouldn't even try to push the device templates or give any meaningful error messages.

It was only when prompted we checked the plugin versions .  Panorama 10.1.8-h2 after upgrade had vm_series-2.1.6 where as the firewall image include vm_series-2.1.7!

A reminder to all on PAN-OS updates not just to check your Panorama is a higher or equal version of Software but also the AV/Threat/ AND plug-in versions!

The reason template push failed specifically to AWS is that we utilize cloudwatch configuration in the template for AWS where as other VM series didn't have this configuration in the template.  The error was not shown in Panorama but basically the template was not compatible with the firewall as Panorama did not have support for 2.1.7.

Other strange issues on upgrade from 9.1.x to 10.1.x :-

We also had issues when setting User ID redistribution agents and they would not connect to panorama or some firewalls.  When using default secure comms certificate the built-in PAN-OS certificate is used, and if this expires again no messages are displayed to make this obvious but in our case the scheduled dynamic content update after upgrade hadn't worked and it required a manual check now, download and install of the latest content version to refresh the built in certificate.  This is not to be confused with other fw certificates as there is also device certificate (used to communicate with Palo Alto Cloud), Cortex Data Lake specific certificate (used to communicate with customer specific instance) in addition to the user based certs that can be installed for Management console or SSL decrypt / Client auth.

Creating this article to help others searching for quick answers!

See also here https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000wkupCAA

[JayGolf]

Hi @Tom-Lee ,

Thanks for sharing this! I will nominate this as an article for more people to see. 

[RobertShawver]

Just FYI, for anyone who happens to stumble upon this, I upgraded from 10.1.10-h1 to 10.2.7 on an esx Pano and an HA pair of physical and got hethe same error.  So in my case it had nothing to do with the vm_series plugin.  They are currently saying that it is a previously unknown bug.