Paloalto - Auto commit failure after upgrade

Issue: Auto commit was keep failing after upgrade

Error logs

admin@paloalto> show jobs all

Enqueued              Dequeued           ID  PositionInQ                              Type                         Status Result Completed
------------------------------------------------------------------------------------------------------------------------------------------
2021/01/12 02:40:25   02:40:25            2                                        AutoCom                            FIN   FAIL 02:40:39 
2021/01/12 02:37:30   02:37:30            1                                        AutoCom                            FIN   FAIL 02:37:43 

admin@paloalto> show management-clients

              Client PRI    State Progress
-------------------------------------------------------------------------
              routed  30 P1-abort        0              
            ha_agent  25 P1-abort        0              
               ifmgr  20     init        0    (op cmds only)
              device  20 P1-abort        0              
              ikemgr  10 P1-abort        0              
              keymgr  10     init        0    (op cmds only)
             logrcvr  10 P1-abort        0              
               dhcpd  10 P1-abort        0              
             varrcvr  10 P1-abort        0              
              sslvpn  10 P1-abort        0              
              rasmgr  10 P1-abort        0              
             useridd  10 P1-abort        0   *          
                satd  10 P1-abort        0              
              sslmgr  10 P1-abort        0              
               authd  10 P1-abort        0              
              pppoed  10 P1-abort        0              
           dnsproxyd  10 P1-abort        0              
             cryptod  10 P1-abort        0              
              dagger  10     init        0    (op cmds only)
             l2ctrld  10 P1-abort        0              
                cord  10 P1-abort        0              

Overall status: P1-abort. Progress: 0
Warnings:
Errors:
useridd: Management server failed to send phase 1 to client useridd

Solution: 

2021-01-12 02:49:10.897 -0800 Commit job enqueued. type=0
2021-01-12 02:49:10.897 -0800 AutoCom job started processing. Dequeue time=2021/01/12 02:49:10 2021-01-12 02:49:15.862 -0800 Error: schedule_policy_push(pan_job_mgr.c:9581): Not scheduling another auto-commit, as auto-commit is already in progress
2021-01-12 02:49:17.082 -0800 Config buf size 0
2021-01-12 02:49:17.174 -0800 Handle content-preview for commit
2021-01-12 02:49:17.175 -0800 Error: _pan_merge_content_preview_pre_commit(pan_cfg_commit_handler.c:2783): Merging content preview - Could not find content preview application node. <<<<<<<<<< Reason for failure

So after running the below command the issue was resolved, and the same has been mentioned in the below link:
https://live.paloaltonetworks.com/t5/general-topics/can-t-do-a-commit-auto-commit-failing/td-p/121977#:~:text=In%20most%20cases%20a%20corrupt,corrupt%20or%20Content%20database%20corrupt.

> request content upgrade download latest
> configure
# commit-force

 

 

Site-Site VPN tunnel between PaloAlto and Cisco vASA

 

Initial Error :

VPN tunnel was failing in IKE Phase 1 between Cisco vASA and Paloalto firewall with below error

 

Initially IKE gateway was configured with peer IP address of tunnel endpoint (public) ip address.

Solution: 

Tunnel came up after modifying the IKE Gateway settings in paloalto as below

Local Identification - Actual tunnel endpoint - Public IP address

Peer Identification - Private IP address which is being used by vASA to negotiate to establish tunnel

 Troubleshooting commands in Paloalto: 

show vpn flow name <Tunnel name>

less mp-log ikemgr.log

GUI:

Monitor - System