HA Configuration Issue with Panorama-Managed Firewall with reason TCP channel failed ,reverting configuration.

[Sushilkumar]

Hi Team,

We are currently facing an issue with a customer related to the configuration of High Availability (HA) in their firewall setup. Below is a brief overview of the scenario:

1. The customer has two firewalls:
• One is managed by Panorama (all configurations are expected to be pushed from Panorama).
• The other is locally managed.
• The goal is to set the Panorama-managed firewall as the active device.
2. HA has been configured locally on both devices.
• The Panorama-managed device was assigned a lower priority to assume the active role.
• The locally managed device was given a higher priority.
• Local commits were successful on Locally managed devices, and HA is currently enabled with the locally managed firewall in the active state.
3. The problem:
• The commit on the Panorama-managed firewall keeps getting reverted with the reason TCP channel failed, reverting configuration, preventing HA from being enabled on that unit.
4. The Panorama-managed firewall is showing as connected to Panorama and there is bidirectional communication.

Could you please help us troubleshoot and resolve this issue?

Regards,

Sushil Kumar.

[TomYoung]

Hi @Sushilkumar ,

That error means that the NGFW has (1) Automated Commit Recovery enabled and (2) after the commit the NGFW lost its TCP connection to Panorama.

https://docs.paloaltonetworks.com/panorama/10-2/panorama-admin/administer-panorama/enable-automated-...

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000g2QnCAI&lang=en_US

It appears that something in your configuration push is breaking the NGFW connection to Panorama.  If you have local access to the NGFW, you could disable ACR and see if the commit succeeds and if the connection to Panorama stays down.

With that said, it is recommended to manage both HA NGFWs from Panorama.  Any Panorama-pushed configuration will NOT be synced with the other NGFW.  It is also recommended that you put the HA pair in the same device group and template stack. This recommendation would require you to use template variables for HA unless you choose to configure it locally.

Thanks,

Tom