VPN Problem after Mgmt Upgrade to R80.20

[Alexander_Schuh]

Hi,

i had this weekend some problems with the upgrade to R80.20.

Following:

Mgmt R77.30  upgrade to R80.20 ( Fresh install / Migrate Import)

Cluster Enviroment is on R77.30.

After a Policy Install from the R80.20 Mgmt one of the two Site to Site tunnels goes down. ( Third Party Tunnel to Palo Alto GW)

Only in P1 and in the VPND.elg i saw that there is a problem with the Pre Shared Secrect ( but i did not changed them)

When i switch back to the old R77.30 Mgmt there are no issues on the Tunnel and it works without some problems.

At the moment I don´t have the logs from the peer GW.

In the FW Monitor I saw traffic on port 500

Had someone this issue?

In the Remotesession with CP we did not found some issues, SE told we need the Logs from the other site.

[Maarten_Sjouw]

I already said this in another post, whatever upgrdae you do, ALWAYS push the policy at least twice before you start troubleshooting.
We had the exact same problem already when we migrated a R77.03 management to another R77.30 management server. (Advanced migration on 2 multi-domain setups into 1 MDS)
Since we apply this rule we do not get reports on failing VPN tunnels anymore.