To test this feature, visit your live site.

Change in NAT Oversubscription hotfix upgrade

During an upgrade from PAN-OS 10.2.3 to PAN-OS 10.2.12-h2 we saw the upgraded firewall go non-functional due to NAT Oversubscription mismatch.

I have seen this when upgrading between major versions, but not in such a minor change.

Is it expected to have a change like this when upgrading maintenance versions?

3 comments

Comments (3)

Reaper

Nov 24

It's been required to have NAT oversubscription be identical on both peers since a long time

It's possible that in 10.2 this setting was actually not checked due to a bug and with the upgrade this was fixed (had a similar issue with HA1 going down due to ping on aux interfaces going from implied to explicit between 11.1.4 and 11.1.5 recently)

Squeaker

Nov 24

Replying to

Thanks

The Oversubscription was set to default, which I would have expected to mean that the settings would match both before and during the upgrade.

This normally would not have been a big deal, except that this pair could not run on firewall B and with A non-functional, the network was down.

Reaper

Nov 24

Replying to

Ah... something similar happened a while back where the "default" was changed and there was a mismatch after 1 member was upgraded.... I was pretty sure it was well before 10.2 but I might be wrong...

You'd need to look into the release notes

Forum: Forum