- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
07-17-2024 02:47 AM - edited 07-17-2024 02:49 AM
Hi,
We recently upgraded our Palo Alto 1410 Firewall to PAN-OS-11.1.2-h3 from PAN-OS-11.0.4-h1.
After Upgrade there was no incoming traffic from external networks. There were no hits or logs showing incoming traffic.
Internet Outbound traffic was going through normally.
IPSEC VPN tunnels were working normally.
Support team checked and wanted us to downgrade to the previous version.
Is this a bug in PAN-OS 11.1 ?
Has anyone ever faced this issue after PAN-OS upgrades ?
Should we install the base image for 11.1 before we upgrade to 11.1.2-h3?
Any ideas and suggestiions are welcome.
Thanks
Hari
07-18-2024 01:42 AM
Can't say i've encountered this issue before due to a bug, but have seen similar things happen due to ARP issues. have you checked upstream MAC and ARP tables, are arp requests for the public IP of the firewall being replied to when inbound packets arrive, are tables updated accordingly?
you could set up packetcapture and follow global counters to see what is happening on the firewall side, also packewt capture the upstream device and see what's going on
in regards to upgrading: you don't need to install the base image, it just needs to be downloaded for you to be able to install maintenance packages
07-18-2024 02:40 AM
Thanks for the update. We hace asked for support from Palo Alto as well. Once i successfully upgrade our 11.0 image to 11.1 image, will keep you updated on the procedure.
07-19-2024 09:06 AM
Hello,
Please have the support team open a ticket with engineering to have them take a look into the issue and obtain the next steps from them. Also as mentioned earlier, base image only needs to be downloaded during the upgrade process.
Thanks,
07-28-2024 10:27 PM
Hi,
No incoming traffic after trying to upgrade 3 different versions of PAN-OS with PA1410 firewall.
On all the 3 occassions we had to revert back to the version which was running on the firewall.
There were no log hits on the "Monitor" showing incoming traffic.
We did see some icmp traffic but not http / https traffic.
From PANOS 11.0.2-h2 to PANOS 11.1.0 - no incomming traffic after upgrade
From PANOS 11.0.4-h1 to PANOS 11.1.2-h3 - no incomming traffic after upgrade
From PANOS 11.0.4-h1 to PANOS 11.0.5 - no incomming traffic after upgrade
We were able to upgrade a version inbetween from 11.0.2 to 11.04 without any issues.
Palo Alto support is still working on the issue.
Any ideas ?
Thanks
Hari
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!