Panorama managed devices lose configuration

[JackTrainor]

On two occasions recently my firewalls stopped functioning correctly following a reboot.

The first time affected a single firewall. I restarted the firewall in order to troubleshoot.

The second time was after a software update. Both firewalls were rebooted.

In both cases when the firewalls came back up they wouldn't process traffic correctly until Panorama pushed the config to them. I think that I have read this before in the documentation, but I can't find it again and I need to understand the correct way to manage a reboot.

Any help would be appreciated.

[PavelK]

Hello @JackTrainor

thanks for posting.

An unexpected reboot is most likely caused by a bug / critical issue. This KB: Critical Issues Addressed in PAN-OS Releases has detailed coverage of all critical issues including version with fix / workaround. I would recommend to review it and upgrade to recommended PAN-OS version: Support PAN-OS Software Release Guidance.

If you are already running recommended PAN-OS version and still experiencing unexpected reboots, I would recommend to generate TAC support file and open a TAC case. This KB: How to Identify and Troubleshoot a Process that Exited or Restarted in PAN-OS might help you to drill down what process caused reboot / data plane restart.

To be honest, I do not think there is any other correct way to reboot firewall than from CLI: "request restart system" and from GUI: Device > Setup > Operations > Reboot Device.

Here is the KB: How to reboot Firewalls in High-Availability Mode how to reboot Firewalls in HA pair.

Regarding the last issue you mentioned that Panorama pushed configuration is lost after Firewall reboot, this is not expected. I personally did not come across this issue and not aware of any post reporting this symptom. After the Panorama pushes the configuration, this configuration is local in the Firewall and should survive any reboot or Panorama being unavailable. If this happens again, I would recommend to check below CLI logs to understand what happen before and after the configuration had to be re-pushed from Panorama, however the opening of TAC ticket might be necessary.

tail follow yes mp-log ms.log
tail follow yes mp-log devsrv.log

Kind Regards

Pavel