PANOS 6 and PA2000 series

[Hithead]

we have a really strange issue with PANOS 6 and PA2000 series.

Sometimes, suddenly the PA doesn't react anymore. Serial, MGT and other Ports are not reacting. Strange thing, the Ports are blinking, but no traffic goes through. MGT Mort does only glow at the left LED.

To get the PA running again, a hard restart (power off/on) is required. We are in contact with the support, but I want to ask  you, if you have the same behavior at PA2000 series?

[HULK]

Hello Hithead,

Could you please let us know, which 6.0.X  version is running on your PAN firewall..? There was an issue reported for PAN OS version 6.0.1 for a 2000 platform.

You may check below mentioned logs for more insight:

-- mp\devsrv.log

-- mp\ms.log

-- mp\masterd_detail.log

-- SYSTEM logs

Thanks

[Hithead]

Hi HULK,

we are running 6.0.2 and 6.0.3 on our four PA2000...

I sent every time PaloAlto the TechSupport files. I guess they already analyze the logs?! But I would do that es well...

During the outage, nothing will be written on the System Logs.

[HULK]

Thanks for sharing the information. (PAN OS 6.0.2 is a very stable release so far). Could you please share your support case ID here.

Thanks

[Hithead]

- 00217759
- 00220354
- 00218191
- 00229008

[pulukas]

Just to confirm, the issue only appeared after the upgrade to PanOS 6.

[Hithead]

correct

[Hithead]

update: same behavior with 5.0.13

[ericgearhart · Accepted solution]

The PA2000 series is basically an "oops" series from Palo Alto. They won't officially come out and say that, but they don't even want the pair of PA2050s we have sitting in our lab back, it's that bad. You should be yelling at your SE and getting a great deal on a PA3000 if you still have PA2000s.

[Hithead]

I liked and marked your answer as correct, because that's truth!

We had now several problems with this series and that's a never ending story. In this case, PA recommended to replace the HDD (on all PAs) and complete Hardware (2 of them) - nothing solved the problem.

@all PA2000 series clients: Don't give up!

[ericgearhart]

I second that, I'm not saying give up either! PA2000s were part of the "first generation" of firewalls PA produced. Any company that puts out a sufficiently revolutionary product is going to have a hard time with their first release... look at the first gen iPhone for an example.

[pulukas]

Thanks for the updates and troubleshooting.  I did  suspect this would be a platform issue and not the PanOS version based on the history of the 2000 series.

I hope you can get some back end discounts for an upgrade as a loyal customer.

[kknight]

see thread Re: PA-2000 Series issues

having the same issues...it is bug in software, so they say, that will be fixed in future release.