topic Re: Problems with configuring Palo Alto PA-500 Firewall in General Topics

Problems with configuring Palo Alto PA-500 Firewall

TigranGevorgyan — Wed, 04 Feb 2015 14:30:29 GMT

Hi Guys,

I can connect via serial and console port from CLI to Firewall. But when i am trying to set ip for management interface i'm getting the following error

Server error : system -> authentication-profile 'LDAP Authentication Profile' is

not a valid reference

Can anybody help me?

Thanks

Tigran

Re: Problems with configuring Palo Alto PA-500 Firewall

hyadavalli — Wed, 04 Feb 2015 14:41:50 GMT

Hello ,

Please try the following command in configure mode to delete the authentication profile and assign ip-address to management interface.

>configure

#delete deviceconfig system authentication-profile

#set deviceconfig system ip-address <ip-address> default-gateway <gateway-address> netmask <net-mask>

#commit

Regards,

Hari Yadavalli

Re: Problems with configuring Palo Alto PA-500 Firewall

mivaldi — Tue, 10 Feb 2015 01:06:17 GMT

It sound like you had this firewall managed from Panorama and commit is failing.

When there's an invalid reference, you usually have objects in the candidate config pointing to other objects that are supposed to be created from Panorama. If the referred-to object is created locally, or if it didn't exist, you may get the "is not a valid reference" error.

What you can do is locate the object that is referencing the Panorama object and delete it.

If Panorama had connectivity to the device, a commit to Template and Device Group should resolve the issue.

You can explore the candidate config with commands:

> set cli config-output-format set

> configure

# show

... to see lines including references to 'LDAP Authentication Profile'

you could issue command:

# show | match "LDAP Auth"

Once the invalid references are cleared, you should be able to commit.

If you don't know how to delete them, please contact Palo Alto Networks Support.

Re: Problems with configuring Palo Alto PA-500 Firewall

Retired Member — Tue, 10 Feb 2015 07:29:40 GMT

Just export the config

Delete "LDAP Authentication Profile"

import the config and try to commit again.

Re: Problems with configuring Palo Alto PA-500 Firewall

pulukas — Tue, 10 Feb 2015 12:59:31 GMT

The advice above will eliminate the commit error.

But the first task is to find out WHY LDAP was configured in the first place and make sure removing this configuration is the correct solution. If LDAP is supposed to be used then there are configuration mistakes made that have introduced this error and they should be investigated and repaired.

Re: Problems with configuring Palo Alto PA-500 Firewall

TigranGevorgyan — Mon, 09 Mar 2015 14:47:37 GMT

Thanks, it helps!