PaloAltoNetworks / xsoar-panos-upgrade-automation

XSOAR Content for managing the PAN-OS Upgrade process.
ISC License
2 stars 4 forks source link

Upgrades with Multiple Hops Fails #40

Open GrantGabbert opened 3 months ago

GrantGabbert commented 3 months ago

Describe the bug

When performing an upgrade that requires multiple steps, the upgrade fails. The failure message was from panorama that the middle software version couldn't be installed because it wasn't downloaded.

Expected behavior

The upgrade should complete successfully, even with multiple steps.

Current behavior

When upgrading for multiple versions (our example was from 10.1.? to 11.1.3-h2 and the upgrade path was identified as 10.2.10-h3, 11.0.5-h1, 11.1.3-h3), the following is what we observed...

When looking at the war room...

And checking the context...

Before digging in, we reran the failed task and it started the software install and then rebooted before waiting for the install to complete.

Possible solution

Two solutions I can think of, but haven't had a chance to walk through could be...

  1. Clean up context between each upgrade. But this would lose some history
  2. Change the 'Yes' conditions to be able to handle multiple iterations of the polling tasks (download, install, reboot).

The customer has also reported that this upgrade path didn't require full upgrades. So potentially some tweaks to the logic that determines the upgrade path could also be beneficial.

Steps to reproduce

  1. Start an upgrade with multiple steps required, our use case was from a 10.1 software to 11.1.3-h2
  2. Wait for the upgrade to fail

Screenshots

War room showing job check for sw download not completed at 10:29:11, but upgrade process continuing at 10:29:12 (customer info removed) image

Context showing both downloads in context. Second, incomplete one as second item (customer info removed) image

Context

Customer was planning on upgrading their entire fleet this weekend with XSOAR. This bug was found and stops the customer from using XSOAR FW Upgrade Assurance and now they will need to manually upgrade.

Your Environment

image