topic Re: Error pushing templates from PANORAMA to PA850 device in Panorama Discussions

Error pushing templates from PANORAMA to PA850 device

weezy — Tue, 13 May 2025 01:58:06 GMT

Hi All,

I'm pushing the templates and variables from our panorama to our new device. The variables are correct and I keep getting an error that says

Validation Error:
. network -> ike -> gateway -> PA-PA-EUR-GW -> local-address -> ip 'x.x.x.x/30' is not a valid reference
. network -> ike -> gateway -> PA-PA-EUR-GW -> local-address -> ip is invalid
. Warning: No Valid Threat License
. Warning: Advance Routing mode is disabled , feature not supported
. Error: tunnel PA-PA-EUR: local interface ethernet1/1 has no IP address configured
. Error: tunnel configuration error
. (Module: device)
. client device phase 1 failure
. Commit failed

When I check the variables the IP is there and as per our SR Net Engr , I just had to keep repeating pushing it until it push completely. I've been trying this since yesterday but no luck. Does the license issue of PANORAMA can affect this?

Thank you for your answers.

Re: Error pushing templates from PANORAMA to PA850 device

mshekh — Tue, 13 May 2025 03:16:54 GMT

Hi @weezy ,

As per error, it's related to configuration, I don't see any relation between license and this error. You can try with commit force once and check if commit force helps.

Re: Error pushing templates from PANORAMA to PA850 device

PavelK — Tue, 13 May 2025 05:02:26 GMT

Hello @weezy

could you make sure that "Include Device and Network Templates" is selected when pushing configuration?

Kind Regards

Pavel

Re: Error pushing templates from PANORAMA to PA850 device

weezy — Tue, 13 May 2025 05:06:53 GMT

//could you make sure that "Include Device and Network Templates" is selected when pushing configuration?//

its always selected as well as the force template push and didn't fix the issue

Re: Error pushing templates from PANORAMA to PA850 device

weezy — Tue, 13 May 2025 05:07:43 GMT

//could you make sure that "Include Device and Network Templates" is selected when pushing configuration?//

its always selected as well as the force template push and didn't fix the issue

I'm working now with PA TAC and they are having a hard time to fix it.

Re: Error pushing templates from PANORAMA to PA850 device

PavelK — Tue, 13 May 2025 06:11:46 GMT

Hello @weezy

thank you for reply.

If TAC is already working on it, you are already in better hands, however only to share. For this kind of error, my next step would be looking into configd.log file (less mp-log configd.log). This file generally includes more details about error.

Kind Regards

Pavel

Re: Error pushing templates from PANORAMA to PA850 device

weezy — Tue, 13 May 2025 06:13:21 GMT

TAC didn't check the MPLOG but suggested to reset the FW instead.

Re: Error pushing templates from PANORAMA to PA850 device

weezy — Tue, 20 May 2025 03:50:07 GMT

This is fix now the PA TAC didn't install the AV and wildfire that is why we are getting an error " destination 'panw-bulletproof-ip-list' is not an allowed keyword"

Our SR engr installed the update and then that fix the issue.