search

PaloAltoNetworks / pan-os-python

The PAN-OS SDK for Python is a package to help interact with Palo Alto Networks devices (including physical and virtualized Next-generation Firewalls and Panorama). The pan-os-python SDK is object oriented and mimics the traditional interaction with the device via the GUI or CLI/API.
https://pan-os-python.readthedocs.io
ISC License
340 stars 168 forks source link

upgrade.py failed: tries to update to an unwanted version #445

Open antoinekh opened 2 years ago

antoinekh commented 2 years ago

Describe the bug

Firewall currently in 9.0.4. package in latest version:

Name: pan-os-python Version: 1.7.1

Upgrade failed with an unwanted version and direction. upgrade failed: Can't upgrade from 10.0.0 to 9.19.

Expected behavior

Upgrade to 9.1.0 then 9.1.9

Current behavior

root@digsflrpng: /app/digsflrpng/api/panorama # python3 upgrade.py -v -n 10.202.22.234 admin password 9.19
DEBUG:panos.base.PanDevice:Getting API Key from 10.202.22.234 for user admin
DEBUG:panos.updater.SoftwareUpdater:Device 016201024862 software updater: check for new versions
DEBUG:panos.updater.SoftwareUpdater:Found current version: 9.0.4
DEBUG:panos.updater.ContentUpdater:Found current version: 8405-6694
INFO:panos.updater.ContentUpdater:Device 016201024862 downloading content version: 8560-7365
DEBUG:panos.firewall.Firewall:Waiting for job to finish...
DEBUG:panos.base:Job 2528 status ACT
DEBUG:panos.base:Job 2528 status ACT
DEBUG:panos.base:Job 2528 status ACT
DEBUG:panos.base:Job 2528 status ACT
DEBUG:panos.base:Job 2528 status ACT
DEBUG:panos.base:Job 2528 status ACT
DEBUG:panos.base:Job 2528 status ACT
DEBUG:panos.base:Job 2528 status ACT
DEBUG:panos.base:Job 2528 status ACT
DEBUG:panos.base:Job 2528 status ACT
DEBUG:panos.base:Job 2528 status ACT
DEBUG:panos.base:Job 2528 status ACT
DEBUG:panos.base:Job 2528 status ACT
DEBUG:panos.base:Job 2528 status ACT
DEBUG:panos.base:Job 2528 status ACT
DEBUG:panos.base:Job 2528 status ACT
DEBUG:panos.base:Job 2528 status ACT
DEBUG:panos.base:Job 2528 status ACT
DEBUG:panos.base:Job 2528 status ACT
DEBUG:panos.base:Job 2528 status ACT
DEBUG:panos.base:Job 2528 status ACT
DEBUG:panos.base:Job 2528 status ACT
DEBUG:panos.base:Job 2528 status ACT
DEBUG:panos.base:Job 2528 status ACT
DEBUG:panos.base:Job 2528 status ACT
DEBUG:panos.base:Job 2528 status ACT
DEBUG:panos.base:Job 2528 status ACT
DEBUG:panos.base:Job 2528 status ACT
DEBUG:panos.base:Job 2528 status ACT
DEBUG:panos.base:Job 2528 status ACT
DEBUG:panos.base:Job 2528 status ACT
DEBUG:panos.base:Job 2528 status ACT
DEBUG:panos.base:Job 2528 status ACT
DEBUG:panos.base:Job 2528 status ACT
DEBUG:panos.base:Job 2528 status ACT
DEBUG:panos.base:Job 2528 status ACT
DEBUG:panos.base:Job 2528 status ACT
DEBUG:panos.base:Job 2528 status ACT
DEBUG:panos.base:Job 2528 status ACT
DEBUG:panos.base:Job 2528 status ACT
DEBUG:panos.base:Job 2528 status ACT
DEBUG:panos.base:Job 2528 status ACT
DEBUG:panos.base:Job 2528 status ACT
DEBUG:panos.base:Job 2528 status ACT
DEBUG:panos.base:Job 2528 status ACT
DEBUG:panos.base:Job 2528 status ACT
DEBUG:panos.base:Job 2528 status ACT
DEBUG:panos.base:Job 2528 status ACT
DEBUG:panos.base:Job 2528 status ACT
DEBUG:panos.base:Job 2528 status ACT
DEBUG:panos.base:Job 2528 status ACT
DEBUG:panos.base:Job 2528 status ACT
DEBUG:panos.base:Job 2528 status ACT
DEBUG:panos.base:Job 2528 status ACT
DEBUG:panos.base:Job 2528 status ACT
DEBUG:panos.base:Job 2528 status ACT
DEBUG:panos.base:Job 2528 status ACT
DEBUG:panos.base:Job 2528 status ACT
DEBUG:panos.base:Job 2528 status ACT
INFO:panos.updater.ContentUpdater:Device 016201024862 installing content version: latest
DEBUG:panos.firewall.Firewall:Waiting for job to finish...
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
DEBUG:panos.base:Job 2530 status ACT
INFO:panos.updater.SoftwareUpdater:Device 016201024862 will be upgraded to version: 9.1.0
INFO:panos.updater.ContentUpdater:Device 016201024862 downloading content version: 8560-7365
DEBUG:panos.firewall.Firewall:Waiting for job to finish...
DEBUG:panos.base:Job 2531 status ACT
DEBUG:panos.base:Job 2531 status ACT
DEBUG:panos.base:Job 2531 status ACT
DEBUG:panos.base:Job 2531 status ACT
DEBUG:panos.base:Job 2531 status ACT
DEBUG:panos.base:Job 2531 status ACT
INFO:panos.updater.ContentUpdater:Device 016201024862 installing content version: latest
DEBUG:panos.firewall.Firewall:Waiting for job to finish...
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
DEBUG:panos.base:Job 2532 status ACT
INFO:panos.updater.SoftwareUpdater:Device 016201024862 will be upgraded to version: 10.0.0
Traceback (most recent call last):
  File "upgrade.py", line 98, in <module>
    main()
  File "upgrade.py", line 92, in main
    device.software.upgrade_to_version(args.version, args.dryrun)
  File "/usr/local/lib/python3.6/site-packages/panos/updater.py", line 350, in upgrade_to_version
    result = self.upgrade_to_version(target_version, dryrun=dryrun)
  File "/usr/local/lib/python3.6/site-packages/panos/updater.py", line 350, in upgrade_to_version
    result = self.upgrade_to_version(target_version, dryrun=dryrun)
  File "/usr/local/lib/python3.6/site-packages/panos/updater.py", line 291, in upgrade_to_version
    % (self.pandevice.id, self.pandevice.version, target_version)
panos.errors.PanDeviceError: Device 016201024862 upgrade failed: Can't upgrade from 10.0.0 to 9.19.
welcome-to-palo-alto-networks[bot] commented 2 years ago

:tada: Thanks for opening your first issue here! Welcome to the community!

jubrad commented 1 year ago

+1

This seems like a relatively large issue, I'm seeing something very similar attempting to upgrade a 10.1.x to 10.2.2-h2. During this it appears as if it fails attempting to upgrade to version 11.0.0 and says no version available.

jamesholland-uk commented 12 months ago

Can you confirm the function you are using from the SDK to do these upgrades, folks? Is it upgrade_to_version? Thanks

Also, in the original post, 9.19 is not a valid version, I presume this was a typo for 9.1.9?