ANDU prechecks fail due to failed task 1618, Upgrade firewall services for deprecation

Applies to

Issue

• ANDU to 9.10 or higher precheck fails due to Upgrade firewall services for deprecation

Cluster::*> cluster image show-update-progress 

                                             Estimated         Elapsed
Update Phase         Status                   Duration        Duration
-------------------- ----------------- --------------- ---------------
Pre-update checks    failed                   00:10:00        00:01:05

• System node upgrade-revert show has the upgrade as aborted on one node and task id 1618 is aborted.  

Cluster::*> upgrade-revert show

  (system node upgrade-revert show)

Node: Cluster-01                                    Status: aborted

Status Message: The upgrade aborted. Contact support personnel for the upgrade repair procedure.

Vers Phase      Status   Upgrade Phase Status Message
---- ---------- -------- ------------------------------------------------------
...
1800 post-apps  aborted  {0}

Cluster::*> upgrade-revert show-task-status -status aborted
  (system node upgrade-revert show-task-status)
Node         Vers Phase     ID  Proc   Status     Description             
------------ ---- --------- --- ------ ---------- -----------------------------
Cluster-01 1600 post-apps 1618 vifmgr aborted   Upgrade firewall services for deprecation

• Running the task and upgrade manually fails

Cluster::*> upgrade-revert upgrade-task -node Cluster-01 -version 1600 -startup-phase post-apps -process vifmgr -task-id 1618
  (system node upgrade-revert upgrade-task)

Error: command failed: {0}

Cluster::*> upgrade-revert upgrade -node Cluster-01 
  (system node upgrade-revert upgrade)

Notice: Upgrade of row [1600,post-apps,1618,vifmgr] failed. Retrying. Reason:
        {0}. 
Error: Upgrade of row [1600,post-apps,1618,vifmgr] failed. Too many retries. 
       command failed: Upgrade attempt failed. 

• In the vifmgr logs we see it failed to find the service policy for a node mgmt lif:  

Tue May 23 2023 13:40:32 -05:00 [kern_vifmgr:info:5929] [0x80ab11600] [Net::AbortableHandle::commit] Caught an exception during commit for lif:rdb:4294967295:Cluster-02_mgmt1 (1013): failed to locate service policy for lif

Tue May 23 2023 13:40:32 -05:00 [kern_vifmgr:info:5929] [0x80ab11600] [Net::AbortableHandle::abort] Successfully aborted commit for lif:rdb:4294967295:Cluster-02_mgmt1 (1013)
 

• Effective Cluster version is the prior ONTAP version.  So a previous ANDU is not complete.   

Cluster::*> version
NetApp Release 9.9.1P5: Sat Nov 20 12:17:23 UTC 2021

• Nodes have upgraded.  

Cluster::*> node run -node * -c version
2 entries were acted on.

Node: Cluster-01
NetApp Release 9.11.1P5: Sat Dec 10 18:54:17 EST 2022

Node: Cluster-02
NetApp Release 9.11.1P5: Sat Dec 10 18:54:17 EST 2022

• Node mgmt lifs have a firewall policy.  

Cluster::*> net int show -fields service-policy,firewall-policy -role *mgmt* 
 (network interface show)
vserver   lif                service-policy     firewall-policy 
--------- ------------------ ------------------ --------------- 
Cluster Cluster-01_mgmt1 default-management mgmt            
Cluster Cluster-02_mgmt1 default-management mgmt            
Cluster cluster_mgmt       default-management mgmt            
...
4 entries were displayed.