topic Re: Not able to delete Vsys1 in Next-Generation Firewall Discussions

Not able to delete Vsys1

JMBerzal — Fri, 18 Nov 2022 13:29:08 GMT

Hello,

We have a problem when trying to delete vsys1 from the FW. Customer enabled multi-vsys and they had two vsys configured. Right now, due to topology changes, vsys1 is no longer required so customer would like to delete that vsys.

The thing is that the PaloAlto won't allow us to delete the vsys1 even tough we have double-checked that there are no more dependencies. I have even downloaded the XML and checked for vsys1 on the configuration, just to make sure that there is no any references to that vsys.

The error the PaloAlto throws is "1 - Failed to delete vsys - vsys1. vsys constraints failed: Cannot delete virtual system 'vsys1' "

Do you have any idea on how to further investigate this issue? Is it a bug?

Customer's affected FW is PA-5050 with version 8.1.21

Thanks in advance,

Jose

Re: Not able to delete Vsys1

Metgatz — Mon, 21 Nov 2022 06:12:26 GMT

Hello @JMBerzal

The Vsys1 can't be delete, it's a default vsys.

Check this links:

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/virtual-systems/configure-virtual-systems

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/virtual-systems/configure-virtual-systems#:~:text=The%20default%20is%20vsys1.%20You%20cannot%20delete%20vsys1%20because%20it%20is%20relevant%20to%20the%20internal%20hierarchy%20on%20the%20firewall%3B%20vsys1%20appears%20even%20on%20firewall%20models%20that%20don%E2%80%99t%20support%20multiple%20virtual%20systems.

Cheers

Re: Not able to delete Vsys1

JMBerzal — Mon, 21 Nov 2022 08:47:15 GMT

Hello @Metgatz

Thanks for the help, I missed that chart on the administration guide. As customer wants to leave only one vsys can we use the expedition tool to move the configuration from vsys2 to vsys1 and delete the vsys2 afterwards?

Cheers,

Jose

Re: Not able to delete Vsys1

Metgatz — Mon, 21 Nov 2022 08:58:32 GMT

Hello @JMBerzal

Hello, I think it is possible, personally I have not done it, precisely what you want to do, but it is something that falls within the scope of Expedition.

https://live.paloaltonetworks.com/t5/expedition-discussions/expedition-tool-to-migrate-vsys/td-p/274669

Another way can be with Load partial:

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-cli-quick-start/use-the-cli/load-configurations/load-a-partial-configuration/load-a- partial-configuration-into-another-configuration-using-xpath-values#idc06fc1f6-6820-4985-b3c4-4664b900dfcd

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-cli-quick-start/use-the-cli/load-configurations/load-a-partial-configuration/xpath-location- formats-determined-by-device-configuration#id34238ccb-2aa0-43d7-a43a-034ee6adf695:~:text=XPATH%20FORMATS-,Multi%2Dvsys%20Firewall,-from%2Dxpath

As always and good practice, run backups

Cheers