topic Re: Can't commit from Panorama in Panorama Discussions

Can't commit from Panorama

ESB-IT — Fri, 02 Jul 2021 10:59:18 GMT

I have two Palo 3200 in HA mode and if I try to commit the configuration change I become following error:

Validation Error:
deviceconfig -> system -> panorama-server unexpected here
deviceconfig -> system is invalid
Commit failed

One of the both firewall is successful but the second one, don't take the configuration and stay Out of sync.

What can I do? Thanks for help

Re: Can't commit from Panorama

S.Cantwell — Fri, 02 Jul 2021 21:55:13 GMT

Can you please ensure that there are no uncommitted local configurations on the secondary FW. Also, can you confirm if you are only pushing out templates (and not device groups)?

When in Panorama mode, the FWs should be getting their configs from the Panorama, so.. have you considered disabled the config sync under the HA portion of the configuration?

It just appears that the xml may be a little corrupted, but nothing too major.

Re: Can't commit from Panorama

ESB-IT — Mon, 06 Sep 2021 05:49:34 GMT

Thanks for your reply Steve, I open a case with the support and we do the following operation, to copy the configuration of the first firewall on the second

1. From peer Firewall that it does not present the issue. SAVE a configuration snapshot under DEVICE > SETUP > OPERATIONS > SAVE > SAVE NAME CONFIGURATION SNAPSHOT

2. EXPORT configurations under DEVICE > SETUP > OPERATIONS > EXPORT > EXPORT NAME CONFIGURATION SNAPSHOT

3. From Firewall with commit error. Make sure document HOSTNAME, MANAGEMENT IP ADDRESS, AND HIGH AVAILABILITY CONFIGURATIONS, since you will be adding again later in this process

4. IMPORT configurations snapshot into Firewall with commit error under under DEVICE > SETUP > OPERATIONS > IMPORT > IMPORT NAME CONFIGURATION SNAPSHOT

5. LOAD configurations snapshot into Firewall with commit error under under DEVICE > SETUP > OPERATIONS > LOAD > LOAD NAME CONFIGURATION SNAPSHOT

6. CHANGE the correct hostname, MANAGEMENT IP ADDRESS , AND HIGH AVAILABILITY CONFIGURATIONS of the Firewall with commit error.

7. Commit