Issues with pushing out 10.2.9-h1

[MannyCosta]

There is not a community discussion for issues implementing 10.2.9-h1

We have a maintenance window to push out 10.2.9-h1 Thursday evening and with recent issues with 1.2.7.h3 and other roll outs i am starting this thread for the community.

[TroyGamm]

I attempted to update Panorama this morning (in preparation for upgrading firewall with GP installed) with a failed result.  The error message was "Failed to install Panorama with the following errors. Label sysroot0 does not indicate a valid image"

This was the first time in 6 years I have had an upgrade fail.

[MannyCosta]

last night upgraded panorama and 2 Azure VM firewalls to 10.2.9-h1 from 10.2.8 without any issues

tonight i will be doing 2 5220s (HA pair) with Global Protect and 10.2.6 with the workaround for the certs.

[MannyCosta]

We finished the upgrade to 10.2.9-h1 last night

There were no issues with our 3- VM300 (new licensing in May) in Azure

I have a HA pair of 5220s with 2 different global protect portals and gateways

we updated the passive then promoted it to active This is when GP connections got a little wonky.

the connections were still showing up on the originator firewall and didnt transfer to the one activated traffic was showing through both some of the new connections were failing on the one GP that split tunneling was enabled. We upgraded the second firewall rebooted and we still had the connections showing up in both firewalls and some seemed duplicated and some were not.

The 5220s were on 10.2.6 with the workarounds and went to 10.2.9-h1

A TAC case will be created  More to follow

[BGS_Academy]

Good morning,

We did our upgrade on the 15th April and have been having issues with sites failing to connect for perhaps 10 - 30 seconds ever since. Issue is intermittent and occurs several times a day, with no obvious reasons why.

Have opened a case with support but no resolution as yet.

[Tremelai]

We updated to 10.2.9-h1 and we're seeing an issue with Panorama templates not working correctly for all interfaces.  All Ethernet, loopback, tunnels, and SDWAN interfaces show 'none' for all virtual/logical routers, zones and IP Addresses even though values exist when queried in CLI.  If I make a change to the template, Pano tries to push out these null values.

[MannyCosta]

I just checked and i am showing the same exact issue with the interfaces VR and LR showing none on the template but it is showing correct in the _stack template.  I have committed some policy changes since the the upgrade but not VR changes and it didnt change the stack template. were you making changes in your routers when it tried to push none to everything. I wont be making any changes till this is resolved. Let us know what TAC says about this when they get back to you. I have a TAC case open on the Global protect issue i had and will do the same