Passive firewall is disconnected from Panorama

[MNoble]

Hello, 

I made the mistake of suspending one of our 440's from HA prior to updating panorama. 

After completing the Panorama upgrade to 10.1.10-h2 from 10.1.6 I went to upgrade the firewall that I suspended from high availability, but it is not listed in Pano. HA status from both firewalls shows enabled/connected when I checked from cli using 'show high-availability state'. I restarted Panorama twice and it's still disconnected from the now passive firewall. Need some pointers on where to look for any logs that may point to why this is happening.

Thanks

[PavelK · Accepted solution]

Hello @MNoble

thanks for posting!

To understand what is happening it is necessary to look into logs. Could you please SSH to Passive Firewall and review logs from CLI by this command: less mp-log ms.log ?

Also, please check below KBs:

Managed Firewalls showing disconnected from the Panorama even though network connectivity is good 

Firewall can not connect to the Panorama after upgrade 

These KBs might be relevant to issue you posted.

Kind Regards

Pavel

[MNoble]

Thanks for the info on the log! Turns out it's an issue with firewall management not being able to get/resolve to panorama or the domain controller. was an NSX issue and has been corrected. 

Thanks