topic Re: rulebase -> security -> rules -> permit_common 'permit_common' is already in use in Next-Generation Firewall Discussions

rulebase -> security -> rules -> permit_common 'permit_common' is already in use

Hovo_Khach — Mon, 25 Sep 2023 15:55:33 GMT

After importing configuration and after clicking on commit I get this, who know how can I solve it
rulebase -> security -> rules -> permit_common 'permit_common' is already in use

Thanks

Re: rulebase -> security -> rules -> permit_common 'permit_common' is already in use

JayGolf — Wed, 27 Sep 2023 18:30:34 GMT

Hi @Hovo_Khach ,

I woud check your security policy rules and search for that specific rule name to see if there is a duplicate. Another way to check errors on commits is to open up the xml config and control + f and search the keyword the error brings up.

Re: rulebase -> security -> rules -> permit_common 'permit_common' is already in use

BPry — Wed, 27 Sep 2023 18:39:57 GMT

@Hovo_Khach,

@JayGolf already mentioned the best way of doing this, but sometimes looking at the XML is the only way to see duplicates for some configuration aspects. The GUI sometimes just won't display duplicates properly all the time, so this may end up being something that you can only fix in the XML properly.

Re: rulebase -> security -> rules -> permit_common 'permit_common' is already in use

nohash4u — Fri, 02 Oct 2026 19:24:48 GMT

Reviving this thread as I ran into this issue when importing a device from one Panorama into another (and wanting to reuse the exact same config from the local NGFW into the new Panorama as a DG and a TS).

First, it is incredibly important to ensure the config from the old Panorama is added to the device locally (as desired in my case), as well as to ensure the NGFW has the correct authkey from the new Panorama. This process is outlined here: How to move a managed firewall from one Panorama to another - Knowledge Base - Palo Alto Networks

Second (where I got caught up again), you need to follow the migration procedure outlined here when importing the device config into the new Panorama to create the DG, Template, and TS. My stumbling point was not pushing the configuration bundle from Panorama to the newly added firewall to removal all policy rules and objects from its local configuration. Specifically, I ran into the issue outlined by "This step is necessary to prevent duplicate rule or object names, which would cause commit errors when you push the device group configuration from Panorama to the firewall in the next step". The key here is to not first push to the newly created DG and Template/TS, but rather use the "Export or push device config bundle" from Panorama --> Setup --> Operations first, and then push to the newly created DG and Template/TS.

I hope this helps!

Cheers