topic Re: Pushing template from Panorama resulting in error in Panorama Discussions

Pushing template from Panorama resulting in error

tjeedigunta — Mon, 20 Jul 2020 21:43:15 GMT

Imported Palo Alto configuration to Panorama

Modified BGP configuration..to be precise added "deny" rules under bgp>import>

committed changes to Panorama

Pushed the modified templates to the same device from where I imported the config.

Commit is failing with below errors:

Details:
. Validation Error:
. import -> network -> interface 'sdwan' is not a valid reference
. import -> network -> interface is invalid
. import -> network is invalid
. import is invalid
. vsys is invalid
. devices is invalid
. Configuration is invalid

request to kindly help me resolve the error.

Re: Pushing template from Panorama resulting in error

reaper — Thu, 23 Jul 2020 11:23:04 GMT

how big is the difference of PAN-OS between panorama and the device?

it appears panorama is tryting to push an sdwan interface and the firewall isn't having it

Re: Pushing template from Panorama resulting in error

tjeedigunta — Thu, 23 Jul 2020 19:59:49 GMT

Panorama is on 9.1.1 and Palo Alto VM is 9.0.6

Is it because of Panorama SDWAN introduced in 9.1.1 that Im not able to push the config?

Re: Pushing template from Panorama resulting in error

reaper — Thu, 23 Jul 2020 20:28:21 GMT

Panorama should normalize configuration to lower version devices

Is the firewall showing up with the right panos in managed devices? Could be an issue with panorama 9.1.1, could give .3 a shot (or get in touch with support)

Re: Pushing template from Panorama resulting in error

RyanMa — Wed, 19 Aug 2020 22:21:10 GMT

I was getting the same error after adding a new device in Panorama. Panorama is running 9.1.2 and local device is 9.0.8. Issue started after Exporting the config bundle from Panorama to the local device. It looks like it is trying to push the "sdwan" interface which isn't available in 9.0. I was able to get around it by deleting the "sdwan" interface. I could not find a way in the GUI but was able to delete from the CLI using the following commands. After deleting on both and committing in Panorama I was able to push to the device from Panorama with no errors.

On Panorama:
configure
edit template "template name"
edit config vsys vsys1 import network
delete interface sdwan

On Local Device:
configure
edit import network
delete interface sdwan

Re: Pushing template from Panorama resulting in error

telco_muguerza — Mon, 28 Sep 2020 14:15:26 GMT

Thanks. It works fine. Same issue with my FW on 8.1.15 to Panorama in 9.1

Re: Pushing template from Panorama resulting in error

orapp — Thu, 13 May 2021 10:06:40 GMT

Thanks Ryan,

On Panorama we did it and it solved the issue:
configure
edit template "template name"
edit config vsys vsys1 import network
delete interface sdwan

Re: Pushing template from Panorama resulting in error

Him007 — Thu, 15 Feb 2024 17:44:31 GMT

I had same problem, no need to downgrade the panorama or firewall code... On panorama go to Virtual Systems under the device tab, select vsys1 (whatever you have) remove sdwan from there & you are good to commit it.