topic Re: Panorama unable to push configuration to the firewalls, "OOXML is not a valid reference" displayed in Panorama Discussions

Panorama unable to push configuration to the firewalls, "OOXML is not a valid reference" displayed

Peter.Li — Thu, 16 May 2024 03:24:25 GMT

Recently we upgrade the panorama to 11-1-2-h3, and found those firewall which under panos version 11.1.2-h3 would occur validation error"OOXML is not a valid reference", we have confirmed the content version and antivirus version of the panorama and the firewall had upgraded to the latest version , it seems that there is a new model called "OOXML" is in the Wildfire Inline ML which in the antivirus profile, we tried to disable it and pushes again, but still didn't work.

Does anybody faced this kind of problem before?

Re: Panorama unable to push configuration to the firewalls, "OOXML is not a valid reference" displayed

WayneF11 — Thu, 16 May 2024 08:49:54 GMT

Hi,

I randomly read posts on this site and I clicked on your post. It appears that you’re encountering a validation error related to the “OOXML” model when pushing configuration from Panorama to firewalls. Here are some steps to consider that you can follow:

Ensure that the content versions on both Panorama and the firewalls match.
Make sure the firewall’s Application & Threats database matches the version on Panorama.
Check for any known issues related to this error.

If the problem persists, you can consider reaching out to support for further assistance. I hope my suggestion will be helpful for you to solve this issue. If you have any questions related to this then you can ask me. I will be glad to help you!

Re: Panorama unable to push configuration to the firewalls, "OOXML is not a valid reference" displayed

Peter.Li — Thu, 16 May 2024 09:22:58 GMT

Hi,

Thanks,I've checked the Application&threat version on both of them, so think I'll open a ticket for this.

Re: Panorama unable to push configuration to the firewalls, "OOXML is not a valid reference" displayed

Daniel_Kruschke — Fri, 24 May 2024 09:54:38 GMT

Hi
we have the same issue.

Our ASC told us the following:

In version 11.1.3 OOXML support for WIldFire Inline ML was added (the docs say 11.1.3, but I could also find it in other 11.1.x versions, so I suspect a typo on Palo's part. https://docs.paloaltonetworks.com/wildfire/u-v/wildfire-whats-new/wildfire-features-in-panos-1113/ooxml-support-for-wildfire-inline-ml [docs.paloaltonetworks.com

Since the Panorama cannot push a feature to the firewalls that is not yet available there, you would either have to upgrade the firewalls once and adapt them to the Panorama or downgrade the Panorama, whichever suits you better.
You should then be able to commit/push again.

But upgrade or downgrade is not an option at this moment. So ticket is opened at PAN Support now.

Re: Panorama unable to push configuration to the firewalls, "OOXML is not a valid reference" displayed

Alerts-Tech — Mon, 27 May 2024 11:06:10 GMT

What worked for us was to delete the line in the CLI referencing the OOXML files. Then the pushes to other, older versions of PanOS work. The OOXML issue only appears if you try to edit the security profile and then make a push

Re: Panorama unable to push configuration to the firewalls, "OOXML is not a valid reference" displayed

agrzybowski — Tue, 04 Jun 2024 09:10:48 GMT

yes, confirmed, you can use command

delete shared /or DG name/ profiles virus <name Antivirus profile > mlav-engine-filebased-enabled OOXML

Re: Panorama unable to push configuration to the firewalls, "OOXML is not a valid reference" displayed

AdamGoepel-Stillman — Fri, 09 Aug 2024 22:14:17 GMT

Logged in to say thank you for this.

It took me a minute to decipher this, if anyone else needs it spelled out even more.

I made an AV in a device group for a specific firewall.

delete device-group Example-Group profiles virus Example-AV mlav-engine-filebased-enabled OOXML

I then I made an altered clone, saw it was going to need to hit multiple FWs, so I moved it up the stack and then got the error on a lot more FWs.

delete shared profiles virus Example-AV mlav-engine-filebased-enabled OOXML

It had also been a few hours since I read the above post and forgot the caveats the user put in the same line. I was getting concerned that this list was empty.

delete device-group Higher -In-The-Device-Group-Example-Group profiles virus Example-AV mlav-engine-filebased-enabled OOXML

I eventually realized my mistake though and found them in shared.

Re: Panorama unable to push configuration to the firewalls, "OOXML is not a valid reference" displayed

levi.rogers — Wed, 21 Aug 2024 01:51:11 GMT

Boy I sure appreciate this level of detail. Thanks for posting this up. I was wondering how I was going to unf*ck this. Cheers.

Re: Panorama unable to push configuration to the firewalls, "OOXML is not a valid reference" displayed

SanilHande — Tue, 19 Nov 2024 22:39:56 GMT

Anyone got resolution from palo alto TAC or removing antivirus profile is only option provided by palo alto ???

Re: Panorama unable to push configuration to the firewalls, "OOXML is not a valid reference" displayed

D.Kruschke — Wed, 20 Nov 2024 07:57:26 GMT

This solution is not from Palo, this is a good workaround. The official solution from Palo is to upgrade all firewalls.

Re: Panorama unable to push configuration to the firewalls, "OOXML is not a valid reference" displayed

Peter.Li — Wed, 20 Nov 2024 08:15:29 GMT

It was caused by PAN-249931 and was fixed in PAN-OS 11.1.2-H4. We upgraded to this version and resolved the issue.

Re: Panorama unable to push configuration to the firewalls, "OOXML is not a valid reference" displayed

SanilHande — Wed, 20 Nov 2024 08:24:12 GMT

We upgraded from 11.1.4-h1 to 11.1.5-h1 we encounter this issue .Ok i am not sure you aware about vulnerability but its not fixing under but 11.1.2-H4 so you have to upgrade PANOS

CVE-2024-9474 PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface

Re: Panorama unable to push configuration to the firewalls, "OOXML is not a valid reference" displayed

SanilHande — Wed, 20 Nov 2024 14:09:54 GMT

I havent understand . Are you able to delete mlav-engine-filebased-enabled OOXML from your antivirus profiles ???? After deleting it , issue was solved for you ?

Re: Panorama unable to push configuration to the firewalls, "OOXML is not a valid reference" displayed

AdamGoepel-Stillman — Thu, 21 Nov 2024 18:20:38 GMT

I have since upgraded all my firewalls to 11.1.2, so I don't have the issue any longer. When I did have the issue, I was able to delete OOXML from the profile. Then, any time I made a change, OOXML would come back. I would need to delete it again. It's a temporary fix really.