topic Re: Unable to revert local changes to aggregate interface in General Topics

Unable to revert local changes to aggregate interface

GGarolla — Fri, 14 Oct 2022 15:05:29 GMT

Hello all,

I have an issue with a couple of HA Palo Alto firewalls managed by Panorama.

I was doing some tests for LACP and I overrode the configuration of an aggregate interface enabling LACP. Then I disabled it again from the firewall GUI (not from Panorama - so I overrode my previous override, I think).

The problem is that now, when I try the revert button, I obtain the following error: "member cannot be deleted because of references from:
network -> virtual-router -> vr -> routing-table -> ip -> static-route -> default -> interface"
I tried the following KB but it did not help (I also did not modify the virtual router configuration at all): Unable to Revert the Interface Config to Panorama Pushed Config - Knowledge Base - Palo Alto Networks

However I noticed that the VR has also the override symbol near the name, even though I did not change it.

What can I do to remove the override and have Panorama push the templates again?

Firewalls are running PAN-OS 9.1.14-h4.

Many thanks!

Re: Unable to revert local changes to aggregate interface

dmifsud — Sat, 15 Oct 2022 21:04:24 GMT

You can use "Force Template Values" to replace the overrides.

Panorama Commit Operations (paloaltonetworks.com)

Check the warning text on the above page, as you need to be really sure before using this option.

- DM

Re: Unable to revert local changes to aggregate interface

GGarolla — Mon, 17 Oct 2022 08:44:58 GMT

Thanks for your response.

Is there a way to quickly check all the values that are currently overriden in the running configuration?

If I select the option "Force Template Values" from Panorama, shall I disable also "Merge with candidate configuration"?