topic Re: Firewall Down Can't Override Panorama Managed Policies/Settings in General Topics

Firewall Down Can't Override Panorama Managed Policies/Settings

StavrosZannikos — Sun, 02 Jul 2023 14:13:29 GMT

Last week we lost one of our sites Acitve/Passive firewalls. An event appeared to happen, that caused the firewalls to try a failover. However the failover failed, and the firewalls were in a "hung" state. When I had smart hands plug into the MGT port, I was able to get into the GUI. The ports all showed "down"(or gray). Previous admins set the network interface IP addresses, NAT policies, and other settings using names objects. The firewall logs showed "invalid reference" errors on these settings(like NAT, and interface). So I wanted to go into NAT, and the interface IP settings, and change them directly to IP to get rid of the invalid reference errors. This didn't work. I couldn't override the Panorama mgmt. The override option was also grayed out. Was curious if anyone had any suggestions? I have opened a case, with Palo, for next week. Thanks for all of your help!

Re: Firewall Down Can't Override Panorama Managed Policies/Settings

BPry — Sun, 02 Jul 2023 15:14:14 GMT

@StavrosZannikos

It kind of sounds like you were logged into the device with an account that wasn't a Superuser. Can you verify what permissions you actually have on the local firewall.

Re: Firewall Down Can't Override Panorama Managed Policies/Settings

StavrosZannikos — Sun, 02 Jul 2023 16:30:16 GMT

Thank you for your reply! The account is the super user account(local account since we can’t AAA due to the firewalls not having network connectivity). It seems there’s some kind of lock from panorama.