topic Re: Panorama not pushing network template changes to devices in General Topics

Panorama not pushing network template changes to devices

gc227s — Thu, 09 Nov 2017 20:48:02 GMT

Hello,

I am very new to Palo Alto FWS so please be gentle 🙂

I have been asked to setup two new PA3060 firewalls to be centrally managed by a Panorama server. Both the Panorama and Firewalls are running v8.0.5.

I have successfully followed the PA instructions to import the firewalls and configs into the Panorama.

However, if I create say a new interface, new sub-interface or new static routes into the virtual router, I commit the changes to the Panorama an then attempt a push to device.

The Commit shows as Completed, however when I access the device GUI, the new interfaces and static routes are not populated in the config of the device.

Any and all help is appreciated.

Thanks & Regards

Grant

Re: Panorama not pushing network template changes to devices

mahmoodm — Fri, 10 Nov 2017 19:21:27 GMT

Hi,

Have u configured them in the device group.

Thanks

Re: Panorama not pushing network template changes to devices

gc227s — Fri, 17 Nov 2017 08:19:47 GMT

Yes, the devices are already in a device group.

Re: Panorama not pushing network template changes to devices

daghastly1 — Mon, 20 Nov 2017 19:37:25 GMT

Are you getting an error? Or does Panorama give you a completed status message? If the push goes through without error but you aren't seeing the changes, make sure the device isn't overriding Panorama. That will be indicated by a green and yellow gear icon. When it's taking Panorama's settings, the firewall will show you a green gear icon. You'll need to login to the device (firewall) via the WebGUI to check this.

Re: Panorama not pushing network template changes to devices

gc227s — Mon, 20 Nov 2017 20:21:31 GMT

Hello,

A check of the Web GUI of the devices shows a green gear icon for those sections affected, namely interfaces, sub-interface and static routes in a non-default VR.

The Push to Device from the Panorama to the devices is not predictable. For example, when setting up a log forwarding profile the commit to the devices fails to both devices. This failed with an error as follows:

Details:
. Validation Error:
. log-settings -> profiles -> syslog -> match-list -> ABC_RTW_LFP_Traffic -> send-syslog 'abc_panorama_syslog_rtw' is not a valid reference
. log-settings -> profiles -> syslog -> match-list -> ABC_RTW_LFP_Traffic -> send-syslog is invalid
. Commit failed
Warnings:

The Panorama Managed Devices view at this point shows the shared policy template as in-sync but the Template out-of sync.

Another more common error is that we create a brand new sub-interface in Panorama, that most definately does not exist on the device, along with an IPv4 address, a new zone and a static route or two. The commit to Panorama is successful but the commit to device fails to only one device this time, namely the passive device in the cluster.

A check of the devices shows config has been pushed. The error in this case is as follows:

To ABCFWDRTW1 device

Details:
. Configuration committed successfully
Warnings:

To ABCFWDRTW2

Details:
. Validation Error:
. network -> interface -> ethernet -> ethernet1/4 -> layer3 -> units -> ethernet1/4.180 -> ip -> 10.215.227.254_26 10.215.227.254_26 is an invalid ipv4/v6 address
. network -> interface -> ethernet -> ethernet1/4 -> layer3 -> units -> ethernet1/4.180 -> ip -> 10.215.227.254_26 '10.215.227.254_26' is invalid. Invalid IPv4 address
. network -> interface -> ethernet -> ethernet1/4 -> layer3 -> units -> ethernet1/4.180 -> ip is invalid
. invalid interface address 10.215.227.254_26(Module: routed)
. Commit failed
Warnings:

Any thoughts, suggestions are appreciated.

Regards

Re: Panorama not pushing network template changes to devices

Layale — Wed, 07 Feb 2018 18:42:52 GMT

Did you find a solution to this problem?

Appreciate it if you can share!

Regards,

Layale

Re: Panorama not pushing network template changes to devices

Pepen — Tue, 20 Nov 2018 09:41:59 GMT

The first time prior to define in Panorama new Template objects you must push the Template from Panorama to the devices with the flag "Force Template values" on (In Edit Selections)

If you don´t do this the first time, all the Template (Network and Device) definitions in the device are marked as "Override" and then the prefered values in the push are the device values.

Values on Override state : PREFERENCE DEVICE VALUES

Values on No-Override State: panorama values

Once you have values on No-Override State you must configure only from Panorama and Panorama values will be /the values on tehe device.

Re: Panorama not pushing network template changes to devices

John_Bell — Wed, 18 Mar 2020 16:22:09 GMT

yes the devices are configured in the correct device group

Re: Panorama not pushing network template changes to devices

weezy — Tue, 13 May 2025 03:17:13 GMT

I got a same error. what did you do to fix the issue? Right now i'm having this issue.