DR Panorama facing issue with the login when performing failover from DC to DR

[Mebinbaby]

Dear Team,

One of our customers is using Panorama for both their DC and DR locations. When the DC Panorama is active, they are able to log in successfully to both the DC and DR Panorama. However, when a failover is performed and the DR Panorama becomes active, they face an issue logging into the DR Panorama, even though the same credentials work fine with the DC Panorama.

This issue does not occur consistently. Sometimes, after the failover, when the DR Panorama is active, users are unable to log in for one or two hours. After that period, the login begins working normally again, but the issue may reoccur intermittently.

When users are unable to log in, no explicit error message appears. After entering the credentials and clicking "Login," the page remains stuck in the redirection phase. We have tested this behavior using different browsers and observed the same issue across all of them.

We also reviewed the system logs and did not find any authentication failure events. Similarly, no relevant events were found in the authd.log file.

Could you please assist us with your expertise on this matter?

[PavelK]

Hello @Mebinbaby

thanks for posting.

While I have not personally came across this issue and nothing comes to my mind what the potential issue could be, I would like to collect more information.

Could you please confirm PAN-OS version of Panorama?

What accounts are being used for login? Local accounts, TACACS+/RADIUS/LDAP, SAML?

Could you please confirm what happens after login? Is the page blank or loading forever?

What is the disk utilization / root partition utilization?

Once you are able to reproduce the issue, would it be possible to collect web debug: How To Collect Web Interface Debug Logs?

If you are able to login by CLI while you are facing the issue could you try to restart web relater process: debug software restart process web-server ?

Kind Regards

Pavel