topic Re: Correct process for adding new firewalls to panorama and then migrating in Panorama Discussions

Correct process for adding new firewalls to panorama and then migrating

M.Allen — Thu, 07 Aug 2025 19:42:08 GMT

I am migrating 820's to 3410s. What is the correct process for adding the two new palos in HA and pushing the new templates and adding them to a device group.

Basic configuration is in place. I have cloned the template I wish to use amended the interface settings and added the 3410s to the new stack.

When pushing the template I get the error

I have not yet added the new 3410s to the old 820 device group..

Should I do this and then push the template to the new 3410 Palos?

Re: Correct process for adding new firewalls to panorama and then migrating

PavelK — Fri, 08 Aug 2025 02:54:50 GMT

Hello @M.Allen

thanks for post!

It does not look like that the issue is caused by not having PA-3410 in Device Group. Could you please confirm PAN-OS version running on PA-3410? I can see this issue addressed in PAN-OS 10.2.8 and 11.1.2:

PAN-223259

Fixed an issue where selective pushes failed with the error Failed to generate selective push configuration. Unable to retrieve last in-sync configuration for the device, either a push was never done or version is too old. Please try a full push.

Also, I have noticed in one post that one LIVEcommunity member reported this being resolved after restart management process in both HA Firewalls.

Kind Regards

Pavel

Re: Correct process for adding new firewalls to panorama and then migrating

M.Allen — Fri, 08 Aug 2025 03:52:33 GMT

Thanks for the reply. Version of Palo’s is 11.1.6 h10

These are new Palo’s and never had a push to them before.

Re: Correct process for adding new firewalls to panorama and then migrating

ozheng — Fri, 08 Aug 2025 10:27:49 GMT

Hello @M.Allen ,

I think you will see the reason in this post.
https://live.paloaltonetworks.com/t5/general-articles/demystifying-selective-push-on-panorama/ta-p/1231335

Olivier

Re: Correct process for adding new firewalls to panorama and then migrating

M.Allen — Fri, 08 Aug 2025 10:30:44 GMT

I have restarted the management process on both Palo CLI's and I am still getting the same error.

Can you confirm that a full push is using the "force template values" button as I am selecting this also.

Panorama is running on 11.1.6 h10 as are both the Palos.

Step 1

Step 2

Device groups set to blank as pushing template first..

Step 3

Step 4

Push?

Error