topic Re: Palo Alto Template Revert error in Panorama Discussions

Palo Alto Template Revert error

MichaelBorg — Fri, 19 Nov 2021 11:39:34 GMT

Hi everyone,

I am a network engineer and we have recently swapped out some Palo Alto firewalls for newer models. The old firewalls were managed in Panorama and I recently tried to integrate these new firewalls to Panorama. I want both the Device Groups (Policies and Objects tabs) and Templates (Network and Device tabs) to be managed by Panorama apart from the Device > High Availability and Setup sections which I want managed locally.

It went smoothly until I reached step 8 in the below Palo Alto document.

https://docs.paloaltonetworks.com/panorama/9-0/panorama-admin/manage-firewalls/transition-a-firewall-to-panorama-management/migrate-a-firewall-ha-pair-to-panorama-management.html

I decided against selecting 'Force Template Values' when I pushed the config to the firewalls because Device > High Availability and Setup should be managed locally, not by Panorama. I was hoping that if I skip selecting 'Force Template Values' I can simply click on everything apart from High Availability and Setup and click Revert locally on the firewall to have this managed in Panorama. When I started doing this however on the Interfaces I got the below error:

Error deleting Ethernet Interface

member cannot be deleted because of references from:

network -> virtual-router -> VR-1 -> routing-table -> ip -> statis-route -> SER_GW -> interface

network -> virtual-router -> VR-1 -> routing-table -> ip -> statis-route -> CanyonRanch -> interface

network -> virtual-router -> VR-1 -> routing-table -> ip -> statis-route -> test -> interface

I have tried to revert VR-1 then do a commit then revert the interfaces but I am still getting the same error above. I don't want to 'Force Template Values' on Panorama as the High Availability and Setup on the local firewalls will be deleted. Any idea how I can add the Template (Network and Device tabs) to be managed by Panorama without adding High Availability and Setup too?

Panorama is version 9.1.8 and model M-100

Firewalls are version 9.1.8 and model PA-5250 in Active Passive setup.

Many thanks in advance!

Re: Palo Alto Template Revert error

BBartik — Mon, 21 Feb 2022 19:04:37 GMT

Any luck on this? I am getting a similar error. In my case, it says it needs to delete them even though interfaces exist in the template. My templates and local config match exactly on the network portions so not sure why I am getting this error. I don't want to use Force template values either for reasons you mentioned.

Re: Palo Alto Template Revert error

JasonPeterson — Mon, 19 Sep 2022 21:10:29 GMT

Is your Virtual Router defined in your template in the same location as the interfaces? I'm running into the same issue, when I look at the templates, I do see something odd where the Virtual Router that is erroring out has a location of NONE in the template but the interfaces are all defined as VSYS1. Was curious if this was the issue.

Re: Palo Alto Template Revert error

BBartik — Tue, 20 Sep 2022 14:14:16 GMT

It seems that the issue is when you do a "revert", behind the scenes the firewall is actually deleting the interfaces from where they are and re-creating everything. It can't do delete because there are static routes tied to the interface. You can see this behavior in the config log.

Re: Palo Alto Template Revert error

geoffmyers_cpt — Wed, 12 Mar 2025 19:23:52 GMT

@BBartik I'm trying to do the same thing as you. Did you ever find any resolution to this without having to force all values? My scenario is such that I have to setup some of the firewalls interfaces and basic policy to reach the management interface across the WAN. After that I want to revert the settings so that everything (except devic and ha) are managed from Panorama. Hopefully you figured something out in 3 years. 🙂