topic Re: Unable to see running config by CLI in a cluster with PA-3060s managed by Panorama. in General Topics

Unable to see running config by CLI in a cluster with PA-3060s managed by Panorama.

Carracido — Fri, 08 Jan 2016 15:32:06 GMT

Hi all,

Maybe you can give me any clue with this issue:

I have a pair of PA-3060 managed by a Panorama and the deployment works fine.

But I´m unable to see the running configuration on the cluster members by CLI. The only shown is the parameters concerning the deviconfig and all the other configurations are not listed. I tried with the same result the following commands:

> show config running

> show config saved running-config.xml

> set cli config-output-format set
> configure
> show

The configuration is properly shown when accessing by WebUI. I tried to reboot the members but everything remains the same.

I´d really appreciate some advice from you. Thanks in advance,

Marcos.

Re: Unable to see running config by CLI in a cluster with PA-3060s managed by Panorama.

Anon1 — Fri, 08 Jan 2016 15:36:42 GMT

This is normal behavior. Configuration pushed by Panorama (rules, objects) are not part of the local configuration and therefore do not appear on local CLI. You can use the "show running ..." to see the rules loaded into dataplane, etc.

Re: Unable to see running config by CLI in a cluster with PA-3060s managed by Panorama.

Carracido — Sun, 10 Jan 2016 12:57:27 GMT

Many thanks for the info.

I have one last question with which maybe you can help me as well: when exporting a config bundle from Panorama, the config XML file for the pair of 3060s is empty. What could I be doing wrong??

Thanks again,

Marcos.

Re: Unable to see running config by CLI in a cluster with PA-3060s managed by Panorama.

reaper — Thu, 14 Jan 2016 10:09:09 GMT

While it is true the panorama pushed config is not visible in the normal config commands, you can actually see the 'pushed' config by using the commands:

admin@firewall> show config pushed-
> pushed-shared-policy   Shared policy pushed to the device
> pushed-template        Template pushed to the device

how exactly are you exporting a config bundle off of panorama? by using the scheduled config export or by other means ?