UUID and HA - dashboard running config not sync'd with peer

[LeeFrancis2]

We have updated an PA-220 HA pair to 9.0.7 and as expected see Policy Rule UUIDs.

We also manage a separate population of FWs by Panaorama 9.07.

From the release notes for HA deployments:

1. policy rules sent by Panorama with apply to both HA member firewalls so they have the same UUID
2. policy rules applied not applied by Panorama with have different UUID on each HA member firewall..

After upgrade this direcly managed firewall dashboard states config not sync'd.

Config audit with peer highlights the different UUIDs. ( along with other HA specific settings )

Given 2 above I would have expected that UUIDs would be excluded form the dashboard status for HA  config sync …

Anyone else experience this on update 8.1 > 9.0 ?

Explanations, remedial actions ?

KR,

Lee

[LeeFrancis2 · Accepted solution]

After investigating other HA peer discrepencies ( dynamic content schedule and licenses ) syning to peer for active fw resolved the issue. It does seem that the upgrade process had triggered the config not in sync condition, but it does not appear to be specific to PAN-OS 9.0 and the differnet UUIDs.

** Note to PAN TAC documentation team :

please add to

"what setting are dont sync in HA":

Policy - UUIDs.

https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/high-availability/reference-ha-synchroniza...

Lee