About IanBroadway

Hi All,   I've been testing a transparent upgrade from 5.1.8 to 5.2.9. (only handful of clients) We're a windows 10 site, 1909 +   So far so good however I have come across a client that refuses to update. the device prompted the update and informed the user of the process, client restarted and reconnected but stayed on 5.1.8.   Looking at the PanGPS log I can see this just after upgrade start   (T10172)Info ( 501): 01/12/22 13:19:33:320 msgtype = software-upgrade (T10172)Info ( 608): 01/12/22 13:19:33:320 #### updater started, command is C:\Users\********\AppData\Local\Temp\_temp20292.msi (T10172)Debug( 39): 01/12/22 13:19:33:320 try verify file C:\Users\********\AppData\Local\Temp\_temp20292.msi (T10172)Error( 165): 01/12/22 13:19:33:391 The file C:\Users\********\AppData\Local\Temp\_temp20292.msi is not signed or corrupted (T10172)Error( 638): 01/12/22 13:19:33:391 file did not signed by us, return now   In the short term this is ok as its reverted and allowed the older version 5.1.8. to continue to work but I'd like to understand the exact issue/cause. I don't want to roll out to 1500 clients and find half don't want to update even if they do continue to work on the older version.   I have found an article here https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HBW9CAO&lang=en_US%E2%80%A9 that specifies a dns related issue but I know the portal fqdn is purely one IP address. There is no different internal address. That article explains multiple reasons for this error but I can't find proof of any other reasons?   One thing I'm also concerned with is the client hasn't tried to upgrade again since? the portal app config specifies a config refresh interval of 1 hour so I would've hoped it would try updating again?     What other reasons would cause this behaviour and why isn't it trying to update the client on reconnect?   Thanks Ian ... View more

Hi All,,   I'm getting this error, see attached, when trying to add new routes to Global Protect Split Tunnel config.     Only thing I can think of, we're running v9 on Panorama and v8 on the firewalls. do the firewalls not like the format when trying to push to them?   they are due to be upgraded to same v9 end of this week, wait and try again after?   Ian ... View more

Hi All,   I carried out an upgrade on a Panorama appliance this morning, M-100 model.   Went from 9.0.6 to 9.0.9-h1. Process was fine however it needed a cold boot (pull power cables) to recover, it did not come back on its own.   Couldn't even console to it. Left it for over 3 hours.   My question is are there any logs within the unit I can retrieve to understand what actually happened?   Thanks Ian ... View more