topic Re: PA 850 ETH1/1 disabled in Next-Generation Firewall Discussions

PA 850 ETH1/1 disabled

weezy — Wed, 14 May 2025 05:38:55 GMT

Need your help we setup a new PA850 to replace our PRIMARY FW in EUR. Now the config has been push to the device however, i'm seeing the eth1/1 is disabled for some reason.

Is there a command that I can forcefully enable it? even on GUI it shows RED status.

I tried to disabled or re-enable it on CLI and I got this error

set failed, may need to override template object ethernet1/1 first

Re: PA 850 ETH1/1 disabled

mshekh — Fri, 16 May 2025 02:16:30 GMT

Hi @weezy ,

Thanks for info, Looks like configuration has been pushed from panorama. if you are enforcing the config from panorama then you can make the changes at panorama template or you can override the config locally at firewall and then make necessary changes as per your requirement.

ukn/ukn/down(power-down) is when you set the Link-State to Disable

disabled/down: You've disabled the interface.

forced/ukn: You've forced the speed/duplex setting and the status of the interface is unknown. Usually caused by unsupported SFPs or if you statically set the link-state to up but the interface is unplugged.

forced/down: You've forced the speed/duplex settings and the interface is down.

Re: PA 850 ETH1/1 disabled

reaper — Mon, 19 May 2025 07:58:42 GMT

@weezy Did you remember to disable ZTP mode after the first boot?

by default new devices boot up in ZTP mode which reserves interface 1/1 for ZTP. this will also block it from being used for anything else

you can disable that using the following command:

set system ztp disable

after a reboot you should be good to go

Re: PA 850 ETH1/1 disabled

weezy — Tue, 20 May 2025 03:43:23 GMT

Our SR. Engr check it and he said that the device on the other end which is cisco core switch interface is on error disabled state so he bounce it and he said that it was up now.

is that also possible too?

Re: PA 850 ETH1/1 disabled

weezy — Tue, 20 May 2025 03:44:31 GMT

after I disable ZTP mode, can I reboot the PA?

Re: PA 850 ETH1/1 disabled

reaper — Thu, 22 May 2025 07:34:48 GMT

yes, reboot is required when you disable ZTP