topic Re: New Panorama migration - commit error when completing in General Topics

New Panorama migration - commit error when completing

a.jones — Sat, 18 Jan 2020 13:00:58 GMT

Hi All,

I have just migrated an active/passive pair of 5220's to Panorama. After completing this following https://docs.paloaltonetworks.com/panorama/8-1/panorama-admin/manage-firewalls/transition-a-firewall-to-panorama-management/migrate-a-firewall-ha-pair-to-panorama-management.html#id177DF10905Z I go to perform step 4 and I get an error which I can't seem to resolve. Can someone help?

Here is the error:

devices -> localhost.localdomain -> template-stack -> mll.pa.fw0.eastnet_stack -> config -> devices -> localhost.localdomain -> deviceconfig -> system -> route -> service -> crl-status -> source is missing 'address'
devices -> localhost.localdomain -> template-stack -> mll.pa.fw0.eastnet_stack -> config -> devices -> localhost.localdomain -> deviceconfig -> system -> route -> service -> crl-status -> source is invalid

Its stopping me in the final stages of deployment.

Regards

Adrian

Re: New Panorama migration - commit error when completing

Remo — Sat, 18 Jan 2020 14:22:53 GMT

Hi @a.jones

According to this error, did you check the service route config? Is there an address configured for CRL status configured or actually should there be one? Maybe you can sove that by manually changing it or then try to delete this, commit and then try to configure it again.

Re: New Panorama migration - commit error when completing

a.jones — Wed, 22 Jan 2020 07:17:11 GMT

@Remothanks. Checked that and found the root cause. It now commits.

Regards

Adrian

Re: New Panorama migration - commit error when completing

MDroyKT — Thu, 22 Jun 2023 22:31:44 GMT

Hello,

I'm having almost the same error:

Validation Error:
devices -> localhost.localdomain -> template-stack -> SEIT-PA-220-LAB-FW_stack -> config -> devices -> localhost.localdomain -> deviceconfig -> system -> route -> destination -> 10.0.128.100 -> source is missing 'address'
devices -> localhost.localdomain -> template-stack -> SEIT-PA-220-LAB-FW_stack -> config -> devices -> localhost.localdomain -> deviceconfig -> system -> route -> destination -> 10.0.128.100 -> source is invalid

But this happens even when I just try to commit it to Panorama, not only Commit and Push. This makes me think that the issue is somewhere in the Panorama configuration? I am unsure of where the issue lies exactly. I didn't think you could create service routes in Panorama, and in the firewall that I'm trying to migrate I added a source IP for the Panorama service route but still get the same error. I also tried just changing the service route to "Use Management Interface for All" but that didn't fix it either.

Any ideas from the error message on where I should check?

Thank you!

Re: New Panorama migration - commit error when completing

PavelK — Fri, 23 Jun 2023 12:53:22 GMT

Hello @MDroyKT

to me it looks like that the issue in your Template is under: Customize > Destination:

What would you like to achieve with the IP address: 10.0.128.100?

If you do not need service route based on destination, I would just delete it, then you should not be getting the commit error. If you want to force Firewall to communicate with Panorama through one of the data plane interfaces, you can use below setting:

Kind Regards

Pavel

Re: New Panorama migration - commit error when completing

MDroyKT — Mon, 26 Jun 2023 19:14:42 GMT

Got it! I just set all the service routes back to "Use default".

Thank you!!