topic Export or push device config bundle in Panorama Discussions

Export or push device config bundle

chens — Tue, 17 Oct 2023 17:20:37 GMT

For some reason, after exporting from Panorama to PA440, using Export or push device config bundle.

The template is not being sent to the 440.

When can be the reason?

Re: Export or push device config bundle

TomYoung — Wed, 18 Oct 2023 00:24:45 GMT

Hi @chens ,

This is something that is not explained very well in the documentation.

Step 5 in the URL below, Export or push device config bundle, deletes the local Policies and Objects (device group configuration) and adds the Panorama pushed Policies and Objects. Your template values are not changed.
Step 6 in the URL below, Commit to Panorama then Commit > Push to Devices, will override the local Network and Device configuration (template values) IF the Force Template Values box is checked. This should be done with care because you could override IP addresses, routes, etc. The NGFW is smart enough not to change the management interface configuration or host name. Generally this should be done only once on the first push after the export/push.

https://docs.paloaltonetworks.com/panorama/9-1/panorama-admin/manage-firewalls/transition-a-firewall-to-panorama-management/migrate-a-firewall-to-panorama-management

Thanks,

Tom

Re: Export or push device config bundle

chens — Wed, 18 Oct 2023 07:40:24 GMT

When i export the device config to the device, the commit fails because there are unknown zones.

Re: Export or push device config bundle

TomYoung — Wed, 18 Oct 2023 11:57:10 GMT

Hi @chens ,

Okay. Your issue is a whole lot more than what you originally said.

Are you adding a new NGFW to Panorama? The only time that you should do step 5 (Panorama > Setup > Operations > Export or push device config bundle) is when you are adding a new NGFW to Panorama and you want to import the standalone configuration.
If you are adding a standalone NGFW to Panorama, did you import the NGFW config into Panorama (step 4)? If yes, then do NOT make any changes to the configuration before step 5.
If you are not adding a standalone NGFW to Panorama, then please do NOT use the term export. It's just push.

Thanks,

Tom

Re: Export or push device config bundle

chens — Wed, 18 Oct 2023 13:24:42 GMT

Yes, I am doing a new NGFW on-boarding to Panorama. Already played around with lab and now in production.

that's why I am exporting (and then "load device-state" in the NGFW). Pushing gives me the known duplication errors.

I think it happened because after i imported the NGFW into the Panorama, i have changed 3 zone names, that's why the commit failed. and after changing them manually (in the local NGFW) and tried to commit, i had other errors like

"vsys -> vsys1 -> plugins unexpected here"
"vsys is invalid"

I thought the device-state contains the network\template info?, doesn't it?

Re: Export or push device config bundle

TomYoung — Wed, 18 Oct 2023 13:45:29 GMT

Hi @chens ,

Okay. Good.

You can delete the device group, template and template stack in Panorama and start the process again. Since the commit failed on the NGFW, you should be able to load last saved configuration and start again.