topic push from panorama to PA firewalal failed because of " is already in use because of policy and NAT already in use) in Panorama Discussions

push from panorama to PA firewalal failed because of " is already in use because of policy and NAT already in use)

Elwess — Thu, 01 Jul 2021 11:01:36 GMT

Hi,

We have panorama in 9.1.9 version and PA-220 in same version.

we imported configuration from pa to panorama, added just e pôlicy rule and pushed again the template and device group to same firewall.

but then we get always pushh failed with errors saying NAT rules and policy rules are already in use !

is that normal ? we have exactly the same rules on device group and on the firewall. , we tried to force value but still we get same eror :

Last Push State Details
Details:
. Validation Error:
. service -> port-2083 'port-2083' is already in use
. service -> port-2083 'port-2083' is already in use
. service is invalid
. rulebase -> security -> rules -> allow all 'allow all' is already in use
. rulebase -> security -> rules -> allow all 'allow all' is already in use
. rulebase -> security -> rules is invalid
. rulebase -> security is invalid
. rulebase -> nat -> rules -> MGMT-to-WAN 'MGMT-to-WAN' is already in use
. rulebase -> nat -> rules -> LAN-to-WAN 'LAN-to-WAN' is already in use
. rulebase -> nat -> rules -> MGMT-to-WAN 'MGMT-to-WAN' is already in use
. rulebase -> nat -> rules -> LAN-to-WAN 'LAN-to-WAN' is already in use
. rulebase -> nat -> rules is invalid
. rulebase -> nat is invalid
. rulebase is invalid

any help please

Re: push from panorama to PA firewalal failed because of " is already in use because of policy and NAT already in use)

jdelio — Thu, 01 Jul 2021 19:07:00 GMT

The already in use can be an issue when you are trying to use Panorama to Manage a firewall and want to re-use the same names for objects..

Please see this article for more information about this.

ADDRESS/ADDRESS GROUP OBJECTS MUST HAVE DIFFERENT NAMES

Re: push from panorama to PA firewalal failed because of " is already in use because of policy and NAT already in use)

Eric_4617 — Sat, 10 Dec 2022 16:27:37 GMT

In case anyone else runs in to this issue, check your template stack and ensure the device is still added. I just ran into a similar issue as OP and in the end, the device was somehow removed from the template stack and had to be re-added. This may have occured when I "disable panorama policy and objects" or the "disable device and network templates". Haven't seen this happen before.

This also applies to the error " $var_SomethingHere' is not a valid reference". Variables don't exist on the local firewall if the device isn't added to the template stack.

Re: push from panorama to PA firewalal failed because of " is already in use because of policy and NAT already in use)

bgooch — Wed, 23 Jul 2025 14:58:18 GMT

Thanks for this! I just ran into a version of this scenario and needed to add the template stack to the device group in order to be able to commit.