topic Re: Commit failure due to ha1-backup interface in Panorama Discussions

Commit failure due to ha1-backup interface

Hamids2021 — Mon, 09 May 2022 17:33:22 GMT

I recently imported a new pair of ha firewalls into Panorama; however, when I push the template with the option force template value enabled, I receive the following error:

**************************************************************************

High-availability ha1-backup interface ipaddr configured to match peer-ip-backup address ( module: ha_agent)

-client ha_agent phase 1 failure

_commit failed

*************************************************************************

Note:

-I've configured the ha1 backup on both firewalls to be the management interface.

-There are no issues when I push the templates without the force template value enabled.

-Panorama OS version is 10.1.5h1, and the firewalls are running on the same version.

Re: Commit failure due to ha1-backup interface

TomYoung — Mon, 09 May 2022 19:35:09 GMT

Hi @Hamids2021 ,

It looks like you are pushing the same IP address to both firewalls. If you want to push the HA config from Panorama, you will need to use template variables so that the IP addresses are different. Alternatively, you could remove the HA config from Panorama, and configure it locally.

Thanks,

Tom

Re: Commit failure due to ha1-backup interface

anon4all — Sat, 02 Aug 2025 18:47:13 GMT

in the panorama configuration, for 2 HA firewalls under on common template, how is it possible to use the template, as only 1 set of opposing-side IP's is exposed in this setting on the general tab:

Peer HA1 IP Address

192.168.255.2

Backup Peer HA1 IP Address

192.168.255.6

the screenshot shows the local firewall config, but if I replace these values in panorama with variables, there is only one spot to do that and if both opposing firewalls are under this one configuration, then they will have duplicate ips, correct? this seem wrong to me.

Re: Commit failure due to ha1-backup interface

TomYoung — Tue, 05 Aug 2025 20:33:08 GMT

Hi @anon4all ,

You use variables in the template configuration, and then edit those variables under Panorama > Managed Devices > Summary for one of the NGFWs so that the IP addresses are different.

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-web-interface-help/panorama-web-interface/panorama-templates/panorama-templates-template-variable

Thanks,

Tom