topic Re: New template stacks after upgrade? in General Topics

New template stacks after upgrade?

jsalmans — Thu, 22 Nov 2018 01:30:07 GMT

Hi all,

I upgraded from an 8.0 release to 8.1.3 to prepare for a migration to some new hardware. I did a commit after the upgrade to make sure everything was synced up between Panorama and the firewalls and I believe everything went ok.

I was making some adjustments at the recommendation of the Best Practices analyzer in Expedition and noticed it failed to commit due to something in a Template Stack. This confused me a bit since I gave up on Template Stacks over a year ago when I first tried them due to not being able to reference values in a template lower in the stack (common values but they had to be referenced in non-common config areas).

I looked again tonight and it appears Panorama created two "_mig" template-stack configs, migrated from each of my two device configs, and moved the devices over to use those.

Was this expected behavoir that I missed in the notes somewhere? If so, is there any issues with moving each firewall back to its original device config and deleting the migrated template-stacks or should we be using template-stacks moving forward?

Thanks!

*edit* Looking at this a little further, it appears the new template-stacks it created are actually each referencing their corresponding original template files. The Commit and Push failed due to a missing "device-id" in the HA configuration.

Re: New template stacks after upgrade?

MP18 — Thu, 22 Nov 2018 02:06:06 GMT

i also saw same behaviour once i upgrade Panormama from 8.0.9 to 8.1

waiting for answer

Re: New template stacks after upgrade?

Remo — Thu, 22 Nov 2018 19:48:45 GMT

This is because of a change in the default behaviour on Panorama with PAN-OS 8.1. Firewalls can o longer be attached to a template, they must be attached to a template stack (even if you don't add any temolates to the stack). Because of that panorama creates template stacks automatically when you upgrade to 8.1 for all firewalls that aren't added to a template stack yet.

Re: New template stacks after upgrade?

MP18 — Thu, 22 Nov 2018 21:21:51 GMT

Many Thanks for reply

Re: New template stacks after upgrade?

jsalmans — Fri, 23 Nov 2018 02:18:38 GMT

@Remo any idea why it would be missing data after migrating to a stack? It seems like if that information was required it would have been in the original template or else I wouldn't have been able to commit.

Re: New template stacks after upgrade?

Remo — Fri, 23 Nov 2018 17:10:36 GMT

@jsalmans

Right now my only idea is a bug - so during the migration this little part got lost...