Update: Opened a ticket with TAC - looks like this is a known issue, although there is no resolution and only a workaround. Workaround= completely shutdown the device and power back on (not a reboot) or to downgrade to 10.1.5-h2 or another previous version. Here's the kicker. We downgraded our PA-3250s in an HA pair one at a time to 10.1.5-h2, and after we tested our Active FW on 10.1.5-h2, GP users were NOT being disconnected (great!) then we downgraded our passive FW, and now the passive FW will not connect to Panorama.
Looks like this is another bug and no work around yet. Still working with TAC....this is frustrating to say the least
... View more