Impossible to migrate an ae interface to a different speed in Panorama?

J.Morgan425685 — Thu, 11 Jun 2026 04:57:27 GMT

Quite new to Panorama, but have been working with Palo Alto standalone firewalls for a little while.

Client has 2 Active Passive HA FW's in Panorama and an ae1 interface with 4x 1G interfaces as members.

They want to switch this to 4x of the 10G interfaces during an outage window.

Am I right that I should be able to just remove the 4x 1G members, add the 4x 10G members in the template in panorama and the commit to the devices?

Client seems to think that this isn't possible, they read somewhere Panorama wont allow it - apparently some sort of order of operations issue where it wont work due to the mixed speeds, though at no point would we have a mix of interfaces at the same time, but they can't find where they read the supposed article. They believe an export, manual config edit and import is the only way...

Has anyone done this exact change and can confirm ?

Re: Impossible to migrate an ae interface to a different speed in Panorama?

PavelK — Sun, 14 Jun 2026 05:13:50 GMT

Hello @J.Morgan425685

thank you for posting!

Unfortunately, I have not done this exact the same operation before, so I can't speak for my own experience, however I spent some time to go through KB articles and documentation. I did not come across any article that reassembles concern of your customer. While there are some limitations what can be configured with AE interfaces from Panorama:

Firewall commit failing with error "aeX 'aeX' is invalid" when new Aggregate Ethernet configuration is pushed from Panorama

Push from Panorama to Firewall fails due to invalid configuration - poe is invalid. Not a PoE port

this operation is fully supported: Configure an Aggregate Interface Group. Especially taking into consideration your customer will arrange maintenance window, I do not see any blocker. If you get an error while committing or pushing configuration to managed Firewall, I would start troubleshooting here based on actual error. In the case you run into an issue with configuration / pushing errors, below commands are helpful to drill down the issue:

Panorama side: mp-log configd.log

Firewall side: mp-log devsrv.log

Kind Regards

Pavel

topic Re: Impossible to migrate an ae interface to a different speed in Panorama? in Panorama Discussions

Impossible to migrate an ae interface to a different speed in Panorama?

Re: Impossible to migrate an ae interface to a different speed in Panorama?