topic Re: Problem with export&push config to newly added firewall in panorama in General Topics

Problem with export&push config to newly added firewall in panorama

stef — Thu, 19 Oct 2023 15:06:18 GMT

Hello,

We are trying to add new firewall to panorama . We follow the steps from the instruction for adding HA cluster to Panorama. But when we get to the step with export&push device config we get an error:

Validation Error:
plugins unexpected here
vsys is invalid

Software version of panorama and firewalls is 11.0.1-h2

We tried several suggestions that we found in previous posts - uninstalling plugins on both panorama and firewalls, restart management server process, load config and force commit etc. but there is no success. Same error.

Can you suggest what and were should we look at .

Thanks in advance!

Re: Problem with export&push config to newly added firewall in panorama

JayGolf — Fri, 20 Oct 2023 00:37:55 GMT

Hi @stef ,

Are the firewalls you have multi-vsys by chance? I see a known issue with 11.0.1 PAN-225337.

Re: Problem with export&push config to newly added firewall in panorama

stef — Fri, 20 Oct 2023 04:32:44 GMT

Hi @JayGolf,

the firewalls are pa-440 . No multi vsys.

Re: Problem with export&push config to newly added firewall in panorama

tonyrobson — Fri, 20 Oct 2023 14:14:33 GMT

I saw this issue when there was configuration in Shared in the network/device templates being pushed to single vsys firewalls, by moving all the configuration out of Shared it solved the issue.

The whole Shared/Multi-Vsys/Single-vsys template management between Panorama and the firewalls is really very problematic in my experience, this is one error of many that I have encountered in this, what I'd give for a month to sit with the developers (if there are any left) of Panorama to fix the quality of life issues.

Re: Problem with export&push config to newly added firewall in panorama

stef — Wed, 25 Oct 2023 06:50:50 GMT

Yes, we had such issues related to shared objects but we manage to fix/bypass them. The only think now is the error with the plugins.

I will open case with palo alto .

PS: "to fix the quality of life" we really need that in next version : )