topic Re: PA440 management interface doesn't take configuration in General Topics

PA440 management interface doesn't take configuration

${userLoginName} — Mon, 18 Apr 2022 17:28:44 GMT

I used to think I knew how to do this stuff, but apparently not. This is an out of the box configuration of a PA440 -

I set the firewall to configure system in standard mode and use static addressing.

Initial config

set deviceconfig system ip-address 192.168.1.1
set deviceconfig system netmask 255.255.255.0
set deviceconfig system update-server updates.paloaltonetworks.com
set deviceconfig system update-schedule threats recurring weekly day-of-week wednesday
set deviceconfig system update-schedule threats recurring weekly at 01:02
set deviceconfig system update-schedule threats recurring weekly action download-only........

Set system to access remotely on my network

set deviceconfig system ip-address 10.x.z.200
set deviceconfig system netmask 255.255.255.0

After commit

set deviceconfig system ip-address 10.x.z.200
set deviceconfig system netmask 255.255.255.0
set deviceconfig system update-server updates.paloaltonetworks.com
set deviceconfig system update-schedule threats recurring weekly day-of-week wednesday
set deviceconfig system update-schedule threats recurring weekly at 01:02.......

Show system info

hostname: PA-440
ip-address: unknown
netmask: unknown
default-gateway:
ip-assignment: static
ipv6-address: unknown
ipv6-link-local-address: unknown
ipv6-default-gateway.......

admin@PA-440> show interface management

Server error : op command for client dagger timed out as client is not available

admin@PA-440> show interface
all Show all interface information
hardware Show all hardware interface information
logical Show all logical interface information
management Show management interface information
<value> <name> interface name

Thanks for the help in advance.

Re: PA440 management interface doesn't take configuration

TomYoung — Tue, 19 Apr 2022 02:52:08 GMT

Hi @${userLoginName} ,

This is the CLI config I send my customers:

admin/admin
set cli config-output-format set
configure

set deviceconfig system hostname HOSTNAME
set deviceconfig system type static
set deviceconfig system ip-address x.x.x.x
set deviceconfig system netmask 255.255.255.0
set deviceconfig system default-gateway x.x.x.x

set deviceconfig system dns-setting servers primary x.x.x.x
set deviceconfig system dns-setting servers secondary x.x.x.x
commit
exit
exit

Thanks,

Tom

Re: PA440 management interface doesn't take configuration

${userLoginName} — Tue, 19 Apr 2022 17:13:46 GMT

Thank you for the reply - The management interface still isn't taking the address assignment. I am still getting:

ip-address: unknown
netmask: unknown

when I do show system info. The interface doesn't ping. I am at a loss.

Thx for the help/

Re: PA440 management interface doesn't take configuration

Remo — Tue, 19 Apr 2022 20:11:08 GMT

Hi @${userLoginName}

Was the commit successful when you configured the IP address and other things? What PAN-OS version is installed on that box? Maybe a dumb question, but did you try to reboot the box already?

Re: PA440 management interface doesn't take configuration

pbalasunda — Tue, 19 Apr 2022 21:49:23 GMT

May be you didn't disable ZTP?

Re: PA440 management interface doesn't take configuration

${userLoginName} — Tue, 19 Apr 2022 22:56:52 GMT

Good questions - the commit was successful - no errors. The OS is 10.1.0. Yes, the box has been rebooted and connected to a known good interface on the switch.

Re: PA440 management interface doesn't take configuration

Remo — Tue, 19 Apr 2022 22:57:51 GMT

... but even with ZTP still enabled the command show system info should not show "unknown" for the IP information

Re: PA440 management interface doesn't take configuration

${userLoginName} — Tue, 19 Apr 2022 22:58:22 GMT

Is there a command line to turn off ZTP. I told the device to use standard config when it was coming up.

Re: PA440 management interface doesn't take configuration

Remo — Tue, 19 Apr 2022 23:00:04 GMT

After that, did you wait long enough (about 2-3 min) until you tried to configure the IP and started your commit?

Re: PA440 management interface doesn't take configuration

pbalasunda — Tue, 19 Apr 2022 23:07:29 GMT

Please do,

> request disable-ztp

to disable ztp.

To check status, run,

> show system info

and look for "zero-touch-provisioning"

Re: PA440 management interface doesn't take configuration

${userLoginName} — Tue, 19 Apr 2022 23:33:51 GMT

yes - i believe so - I waited until the all the lights were green.

Re: PA440 management interface doesn't take configuration

${userLoginName} — Wed, 20 Apr 2022 00:03:13 GMT

Is this bad?

admin@PA-Firewall> request disable-ztp

Server error : Not a supported operation on this platform

Re: PA440 management interface doesn't take configuration

Remo — Wed, 20 Apr 2022 05:35:42 GMT

Yes it is. I recommend you to contact support by opening a TAC case.

Re: PA440 management interface doesn't take configuration

${userLoginName} — Wed, 20 Apr 2022 17:29:25 GMT

admin@PA-Firewall> show system ztp status
Zero touch provisioning disabled by user

Re: PA440 management interface doesn't take configuration

Remo — Thu, 21 Apr 2022 21:13:49 GMT

@${userLoginName} did you name your firewall manually "PA-Firewall"?

Re: PA440 management interface doesn't take configuration

CITNetwork — Mon, 17 Oct 2022 16:23:58 GMT

try this "@PA-440> set system ztp disable"

Re: PA440 management interface doesn't take configuration

towerpinkster — Fri, 26 Jan 2024 18:43:33 GMT

I was having the same issue after upgrading to a newer software version. The initial configuration out of the box was working fine. The management IP address setting disappeared when I upgraded to 10.2

I used the following format and the address stuck.

configure

set deviceconfig system type static

set deviceconfig system ip-address 10.x.x.x netmask 255.255.255.0 default-gateway 10.x.x.x dns-setting servers primary 8.8.8.8

commit

exit

show interface management