The PA-3020 in the HA pair cannot automatically run dynamic updates.

[DevonFan]

Hi All,
I have two PA-3020 that are HA setup, version 9.1.9.
Since the beginning of March, I have found that dynamic updates often fail. Strictly speaking, downloading images is normal. However, one firewall updates normally and the other fails to update, causing the two firewall versions to mismatch. But it does not always fail to update automatically, and the probability of occurrence is about 50%.

active one:

active one

passive one:

passive one
At the beginning of April, we updated the firewall version to 9.1.12. After two weeks of observation, I found that the problem still exists.

If I install the image file directly, there will be an error.

fail detail

At present my solution is: delete the downloaded image file -> manually download the image file -> manually install the latest version

How can I fix this problem?

Thanks.

[BPry]

@DevonFan,

It's not recommended to have both active/passive units set to use the same exact dynamic update scheduled, especially with sync-to-peer enabled. Offset these so that both units aren't kicking off at the exact same time. 

[TomYoung]

Hi @DevonFan ,

"Sync-to-peer" is intended when the HA secondary has no path to the Internet from the management interface.  I would disable it.  Also, this article reiterates what @BPry said.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClrnCAC

Thanks,

Tom

[Remo]

I recommend the same as @TomYoung : disable the sync-to-peer option and your problem should be solved. In order to have the updates installed as soon as possible, think about changing the update values to checks more often. Mainly the antivirus update foe the case when it is released at another time than normal. I do also the same for the apps and threats updates, but I configured a threshold to avoid problems with bugs in these updates. Only in situations of emergency updates or when important vulnerability signatures are released, I install the update manually prior to the threshold time specified.

[DevonFan]

Hi all,

Thanks for the suggestion, I'll modify it and see if it improves.
But I have another pair of firewall PA-820 and they have the same situation yesterday.
I'm wondering if it's the sync to peer settings that caused the installation to fail?

active onepassive onefailed details

(Please ignore the miss of Antivirus on 4/20, there was a problem with network to Internet on that day and the download and update were not scheduled.)

[Remo]

Hi @DevonFan 

In this case probably your disk is full. Try to remove the old content updates and also PAN-OS images. Here you can find some more information about cleaning the root partition: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClaJCAS