Taking longer time to commit on firewall from secondary panorama

[PankajDhobe]

• As observed, when primary panorama was active, I have created an Test address object and committed and pushed from panorama. Configuration committed and pushed within 2 to 3 minutes.
• After making secondary panorama as an active, configuration was committed after longer time period around 12 to 15 minutes.
• As observed on both primary and secondary panorama, there was not any configuration difference between the two.
• If anybody is well known about the issue. Please, let me know.

[BPry]

@PankajDhobe,

How far apart was the failover and the attempt to actually push configurations out? Did you attempt to do that shortly after the failover? 

[PankajDhobe]

Configuration commited successfully when secondary was active.

But while pushing configuration to the device group, it was taking longer time. Stuck at 50% for few device group and for some, commit was showing at 0% for 4 to 5 minutes, after that percentage started increasing.

So total duration to push is in between 10 to 15 minutes

But when primary was active configuration was pushed within less time about 2 to 3 minutes.

If it is known issue, please let me share your suggestion.

[BPry]

@PankajDhobe,

That's certainly not a known issue or expected behavior. It's possible that the system was already running a lot of jobs and simply couldn't queue these as quick as you are used to, but either way if you continue to see this behavior I would log a case with TAC so they can actually review logs. The system should behave exactly the same regardless of which node is active.

[nikoolayy1]

Just in case check this article  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm1CCAS and CPU and memory of the secondary panorama before and when you coomit :

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClUbCAK