topic Re: Hide/show local configuration objects in Panorama Discussions

Hide/show local configuration objects

treysgrun — Fri, 10 Jun 2022 23:16:03 GMT

Was running 9.1 on all firewalls. 10.0 on Panorama. Then something stupid happened and couldn't sync my HA pairs. I was forced to upgrade everything to 10.1.5.

In the name of all that's stupid, on my local firewalls, when I log in, it shows me both the locally configured ipsec tunnel and the panorama configured tunnel object (the green gear). Is it possible to show me just ONE????

I have been searching for the last 2 hours for how to hide one or the other - the local or template pushed configuration elements, I don't really care which since they should be identical, and I'm sure it's simple, but why isn't it obvious. Screenshot for reference - we have over 300 tunnels:

Re: Hide/show local configuration objects

aleksandar.astardzhiev — Thu, 07 Jul 2022 13:02:27 GMT

Hi @treysgrun ,

This shouldn't be happening. If overlapping configuration exist between local and panorama pushed, you should see green with yellow gear next to the object. This could be somekind of cosmetic bug caused by combination of sync issue and upgrade.

Try the following on the firewall:

- Select tunnel interface, not clicking the name, but rather check the checkbox)

- Click on "Override" button at the bottom. This should open the interface edit dialog, without changing anything click OK.

- Check if now you see only one entry for that interface

- Select the tunnel again and click "Revert" at the bottom.

- You should see single entry with the green gear next to it.

- Commit locally on the firewall.

Re: Hide/show local configuration objects

treysgrun — Tue, 26 Jul 2022 05:07:13 GMT

Thanks very much for your help. Your reply seemed reasonable, I have used the override function in the past - mostly when troubleshooting specific problems syncing the local firewall to panorama. In this case, on the local firewall, there is no "override" option:

I am scared to both try and delete the duplicate tunnel, and remove and re-connect the firewall to Panorama.

TAC has told me this is a bug, but it's very annoying to think I might have to upgrade again to address another bug.