topic Re: failed to generate selective push in Panorama Discussions

failed to generate selective push

marie-merlier — Mon, 13 Mar 2023 17:09:09 GMT

Hello,

I'm struggling with the integration of new devices, after many tries, I finally removed the new devices, but 2 of the other firewall can't commit anymore :

when I try to push to devices, I've got the following error "Failed to generate selective push configuration. Last in-sync configuration for the device is from a different version, selective push is not supported. Please try a full push."

What is a full push by the way?

In summary page the status is :

- both devices of the device group are connected

- shared policy is "out of sync Panorama pushed version :360"

- template is "out of sync Panorama pushed version :331"

I've tried from Setup> Operation, to "export or push device config bundle" on these specific devices using version 331".

the load is working fine, then I commit to Panorama, which is also fine.

But pushing to devices fails for template and device group.

What would be the next step to recover a valid configuration that won't disturb the service on the firewalls ?

Re: failed to generate selective push

s.ewald — Tue, 28 Mar 2023 10:00:45 GMT

Hi there,

this is a known problem and will be fixed in the upcoming version 10.2.4. Check this article for the workaround provided by palo:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000kGFFCA2

Re: failed to generate selective push

MohammedShanawazuddin — Thu, 27 Apr 2023 15:13:35 GMT

What is a full push by the way?

When you commit and push the configuration there are 2 options as mention below.

Select the option 1 is full push

1. Commit And Push All Changes - If you select this is full push
2. Commit And Push Changes Made By: - If you select this is changes push by individual users.

Re: failed to generate selective push

s.ewald — Thu, 27 Apr 2023 15:39:22 GMT

A full push will send the existing configuration from the panorama to all firewalls without any changes.

If there is a Panorama OS Upgrade the full push will update the XML structure that is used in the new OS Version on the firewalls. The push still will not change anything related to the configuration.

Re: failed to generate selective push

Aimee — Wed, 28 Jun 2023 18:15:43 GMT

When I try to do their workaround - Commit And Push All Changes - my commit and push button is grayed out.

Re: failed to generate selective push

kiwi — Fri, 30 Jun 2023 09:57:07 GMT

Hi @Aimee ,

Make sure it's not a permission issue (your user can perform this action ?)

Check if Device State shows as connected under Panorama > Managed Devices > Summary section.

Seems obvious but make sure there's a Push Scope to push to... if there isn't then edit the selections and select the Device Group/Template to push to.

If all else fails, you can try restarting the mgmt server process.

Kind regards,

-Kim.

Re: failed to generate selective push

dkane66 — Thu, 20 Jul 2023 03:11:49 GMT

Issue still exists in 10.2.4-h3. Was told to move to 10.2.4-h3 to avoid the issue, no luck.

Re: failed to generate selective push

Natedogg — Thu, 20 Jul 2023 17:50:19 GMT

Same. Currently running 10.2.4-h2 and this is still happening.

Re: failed to generate selective push

WayneRandall — Thu, 27 Jul 2023 02:43:23 GMT

Any update on this? I'm having the issue after upgrading firewalls to 10.2.4-h2. 3 out of 10 firewalls. 2 PA-220's and 1 PA-820.

Re: failed to generate selective push

Natedogg — Thu, 27 Jul 2023 12:23:46 GMT

This is happening to our entire deployment. Panorama and log collectors are on 10.2.4h2 and all firewalls attached are at 10.1.8. Full push never helps.

Re: failed to generate selective push

dkane66 — Thu, 27 Jul 2023 14:21:32 GMT

Still no update from my Case or SAM team on this one. A full push should resolve the issues but only temporarily. For us right now we have to do a full push about every 3 or so commit/pushes. It sucks, I believe I see the issue and have relayed it to TAC. The safety feature of forcing a full push when something is over 100 revs off is taking into account items that are in a disconnected state. When I look at my required full push, everything that is labelled as out of sync and in need of a push are items that are either Disconnected or not fully managed by Panorama.

Re: failed to generate selective push

Aimee — Thu, 27 Jul 2023 15:21:33 GMT

I downgraded to Software Version 10.2.3-h4 and I don't have the issue anymore.

Re: failed to generate selective push

Aimee — Thu, 27 Jul 2023 15:24:31 GMT

Try downgrading to Version 10.2.3-h4 if you can. (I don't know what version your firewalls are running) I don't have the issue anymore after moving to 10.2.3-h4.

Re: failed to generate selective push

Natedogg — Thu, 27 Jul 2023 15:26:10 GMT

Does it matter what version the firewalls are on? I thought it had to do with what version Panorama was running. Firewalls are on 10.1.8 and Panorama and log collectors are on 10.2.4h2

Re: failed to generate selective push

dkane66 — Thu, 27 Jul 2023 15:54:49 GMT

It should just be the version of Panorama and for me it seems to be with 10.2.4 code. Was on 10.2.3 no issues, moved to 10.2.4 issue started, was told by TAC the issue was resolved in 10.2.4-h3 they even have it posted as a resolved issue in the Release notes. Issue still persists. It seems like 10.2.4 should just be avoided if you are able to, especially if you have a large Palo footprint and a lot of people making changes in Panorama.

Re: failed to generate selective push

Aimee — Mon, 27 Nov 2023 22:15:50 GMT

Well the issue is still an issue in 10.2.3-h4. And I see another user posted it is still apparently an issue in 10.2.6.. Is there a true bug fix in any of these revisions?

Re: failed to generate selective push

Aimee — Mon, 27 Nov 2023 22:22:18 GMT

Editing to add that I still have the issue with my firewalls. It appeared to have gone away, but started again. And on top of the selective push issue, Panorama will say a push completed, the firewall will say the push completed, but when you look for the changes in the firewall, they do not exist. Then you have to do a push to devices to force the push.
I decided to downgraded to 10.2.3-h4 and I don't have the issue anymore. I can commit and push without any errors. But my firewalls are on 10.1.10 build, so I was able to downgrade Pano without having any issues.

Re: failed to generate selective push

Natedogg — Fri, 28 Jul 2023 18:51:33 GMT

Just downgraded to 10.2.3h4 and we are not having this issue anymore. Thanks for the advice folks.

Re: failed to generate selective push

Adrian_Dorse — Fri, 11 Aug 2023 06:03:08 GMT

Interesting thread. I am too experiencing this issue and am running 10.2.4. (Still no update from my Case or SAM team on this one. A full push should resolve the issues but only temporarily. For us right now we have to do a full push about every 3 or so commit/pushes. It sucks, I believe I see the issue and have relayed it to TAC. The safety feature of forcing a full push when something is over 100 revs off is taking into account items that are in a disconnected state. When I look at my required full push, everything that is labelled as out of sync and in need of a push are items that are either Disconnected or not fully managed by Panorama). <- this is an interesting remark. I have a couple of firewalls in this scenario where customers have delegated rights and neglect to inform us of key activities resulting in firewalls being in a semi decommissioned state. Will open a case with PANW and update the thread (if there is anything positive to report) just in case others are still facing this issue, but housekeeping is my next tactical approach as downgrading is not an option open to me.

Re: failed to generate selective push

dkane66 — Fri, 11 Aug 2023 13:02:43 GMT

For those that are sticking with 10.2.4 The workaround from Tac didn't work. This though does work but it is still not a proper selective push. Without Fail we have been able to do pushes to specific firewalls but you still have to select the all Admins section. This is the only way we can consistently make pushes with out a failure and being asked to do a Full Push. Not a great work around but it has been working for us so far, since you can still do a selective commit.