topic Re: Ansible created rules getting "hip-profiles is a duplicate node" when modified through GUI. in Automation/API Discussions

Ansible created rules getting "hip-profiles is a duplicate node" when modified through GUI.

gangqu — Wed, 17 Feb 2021 18:37:17 GMT

Panorama is on version 10.0.1 and device is on version 9.1.x.

I am able to create rules in Panorama and the rules are pushed to the device. Everything looks fine at this point.

When I modify the rules through GUI, like adding a group tag, etc. Panorama doesn't complain, but pushing to the device always fails with "hip-profiles is a duplicate node". There is no HIP defined and all the rules has 'any' as 'HIP Profile'.

Version differences might be what's going on here, but I would like to know what the ansbile scripts are doing to causing this issue and find a way to avoid this.

has anyone had simliar experience with this?

thanks.

Re: Ansible created rules getting "hip-profiles is a duplicate node" when modified through GUI.

davidbla — Wed, 24 Mar 2021 18:11:53 GMT

The issue is because of the "device / hip profile" option for policies introduced in 10?.

I just was not able to find this feature in the release notes... can s/o link it?

Panorama knows this new kind of filter:

But your firewall not.
Even if you don't configure it but change smth in the policy, panorama will add a "hip-profiles any;" to the configuration.
And the device, witch does not know about such a configuration option, somehow interprets this as "hip-profile is a duplicate node".
However it also reports back "rules is invalid".

I've no idea yet to fix it. I have do overwrite new changes on the firewall directly because I am not able to push this template from panorama.

You can easily proove it by using a configuration previev.

--edit

we were able to work arround things. this issue seems just to effect for cloned rules.

you can delete these lines from panoama cli before commiting to the firewalls.

Re: Ansible created rules getting "hip-profiles is a duplicate node" when modified through GUI.

SedgwickITSupport — Mon, 29 Mar 2021 15:09:54 GMT

thank you, solution verified.

Re: Ansible created rules getting "hip-profiles is a duplicate node" when modified through GUI.

gangqu — Mon, 29 Mar 2021 15:28:16 GMT

thanks, solution verified.

Re: Ansible created rules getting "hip-profiles is a duplicate node" when modified through GUI.

davidbla — Tue, 13 Apr 2021 09:43:59 GMT

added the WO - just to be precise:

configure delete device-group <device group> pre-rulebase security rules "<rule name>" source-hip delete device-group <device group> pre-rulebase security rules "<rule name>" destination-hip

Re: Ansible created rules getting "hip-profiles is a duplicate node" when modified through GUI.

Victor.Aranda — Wed, 23 Jun 2021 06:19:03 GMT

For me it was:

delete device-group <device group> pre-rulebase security rules "<rule name>" hip-profiles