Configure PAN OS locally when panorama is down

Bouthaina — Wed, 05 Feb 2025 09:22:15 GMT

Hello team,

I want to ask if when the panorama VM is down , and we need to configure firewalls locally, in this case , when we turn on the panorama , how would be the behaviour :

1- Panorama will detect that configuration is not sync and will inherit from FW?

2- or , the changes will not apear in panorama , and how to add these changes to panorama ?

Thank you 😊

Re: Configure PAN OS locally when panorama is down

PavelK — Wed, 05 Feb 2025 23:19:55 GMT

Hello @Bouthaina

thanks for post!

- The changes you make locally in Firewall will not be reflected in Panorama. Local configuration is bound only to Firewall.

- Local changes are not sync back to Panorama's Device Group / Template. You will either have to make the identical changes in Panorama and push it back to Firewall. This step has however following limitations: Template configuration will not override local configuration until you override it locally. Details are in this KB: Pushed config from Panorama not being applied on the local Firewall. Identical configuration in Device Group for example object names will result error while pushing back to Firewall as the same object name already exists locally. You will have to resolve this issue first.

The alternative to this would be to import local configuration to Panorama: How to add a locally managed firewall to panorama management.

Kind Regards

Pavel

topic Configure PAN OS locally when panorama is down in Next-Generation Firewall Discussions

Configure PAN OS locally when panorama is down

Re: Configure PAN OS locally when panorama is down