Vsys name and Zone name commit fail

micharr — Mon, 27 Mar 2023 23:25:00 GMT

I wanted to share this experience and maybe see if this is a bug or simply a condition of how PAN works.

I am migrating multiple ASA contexts into a multi-vsys PAN environment. I was doing a partial load config/xpath sequence from the CLI and I got errors on moving the vsys over.

After much testing the solution was to make sure the name of the vsys and the name of a security zone were NOT an identical match. In our case, changing the name of the vsys is much easier than a security zone where the subsequent rules did not automatically change the referenced zone name. Again, not sure if this is a bug or if this has to be this way as a result of how PAN processes things.

Re: Vsys name and Zone name commit fail

lychiang — Tue, 28 Mar 2023 02:33:51 GMT

@micharr You are correct, PAN-OS does not allow to have same name on vsys and zone , I just tried to create a new zone called "vsys1" and it is showing error message said vsys 1 already exist. So this is not a bug from Expedition.

topic Re: Vsys name and Zone name commit fail in Expedition Discussions

Vsys name and Zone name commit fail

Re: Vsys name and Zone name commit fail