topic Device Config Import into Panorama removes all the objects in General Topics

Device Config Import into Panorama removes all the objects

raji_toor — Tue, 15 Aug 2017 21:23:28 GMT

We have firewalls in HA and are multi-vsys. I am trying to to get them into Panorama, but as i import the config it removes almost all objects and Panorama device groups only shows shared objects. Any object that was local to to vsys does not show and they are gone completely from firewall. Also for the same reason a push from panorama or local commit fails as objects are missing that are being pointed to by the firewall.

Re: Device Config Import into Panorama removes all the objects

Remo — Tue, 15 Aug 2017 21:38:30 GMT

Try it this way:

Import configuration to panorama and check the checkbox for creating shared objects in panorama shared context
If you need to change something in the config, do it now and then do a panorama commit
Export the device state to the firewall. Only export, not export and commit.
Connect to the firewall, go into config mode and enter the command "load device-state". Still no commit.
Push the configuration from panorama to the firewall and check the checkbox for include template values and merge with candidate config.

At least I migrated sucessfully more than 6 clusters this way (Panorama was on PAN-OS 😎

Re: Device Config Import into Panorama removes all the objects

raji_toor — Tue, 15 Aug 2017 21:58:34 GMT

Can you elaborate how to do step 3. Do you mean exporting the config locally.

We are on 7.1.9, also would the 1st step import all the objects inindvidual vsys into panorama.

Export the device state to the firewall. Only export, not export and commit.

Re: Device Config Import into Panorama removes all the objects

Remo — Tue, 15 Aug 2017 23:27:06 GMT

Had to check shortly if step 3 already is possible with PAN-OS 7.1.

But according to the admin guide, step 3 can be done (as with PAN-OS 😎 here:

Panorama > Setup > Operations and click Export or push device config bundle

There (if you go the same way as I described) you have to choose the device and then "push" the device state. (Export was little bit of the wrong word to describe what I meant)