PaloAltoNetworks / xsoar-panos-upgrade-automation

XSOAR Content for managing the PAN-OS Upgrade process.
ISC License
2 stars 3 forks source link

Non-HA Firewalls Fail Readiness Check #20

Open GrantGabbert opened 4 months ago

GrantGabbert commented 4 months ago

Describe the bug

If a firewall isn't configured for HA, the readiness check will always fail.

Expected behavior

The HA readiness check should only be run when the firewalls are configured as HA pair.

Current behavior

The HA readiness check is always included, regardless if the firewalls are configured for HA or not.

Possible solution

When performing the default readiness check, only include HA check if the firewall is configured for HA (enabled = yes)

Steps to reproduce

  1. Run the default readiness check on a firewall not configured for HA (eg !pan-os-assurance-run-readiness-checks firewall_serial="XXXXXX")
  2. The HA check will fail

Context

When upgrading non-HA firewalls, there is additional validations required due to the readiness check failing. The upgrade stops, the user has to review the readiness check, and manually continue the upgrade.

Your Environment