topic Re: Panorama Template Push issue in General Topics

Panorama Template Push issue

a.jones — Thu, 26 Mar 2020 12:56:43 GMT

Hi All,

I have an issue with a Template push to device issue.

I have added some routes in the BGP import section and have committed to Panorama without issue. When I push to device I run into a couple of separate issues which is causing me problems.

When I push to devices using the force template values I get issues concerning HA and this error: ha1-backup interface ipaddr configured to match peer-ip-backup address

My setup is an active passive pair with unique management addresses, unique hostnames.

HA is configured with unique IPs for Peer HA1 on both, pointing to the IP set on Control Link HA IP set on the opposite device. The backup HA is configured to work on the management interface and the peer set to opposite device IP.

If I don't force template it is all okay, and it works apart from the config is not pushed.

If I force the template, the passive device fails with the error above but the primary device has the config on.

Question is how to resolve this through Panorama? If it can't, is it best to do this config on the device and is that achieved by selecting the "Disable Device and Network Template" in Device>Setup>Panorama settings?

Secondary quicky question - is it best to have sync config ticked post migration to Panorama as the documentation wasn't clear whether to enable it or not?

Regards

Adrian

Re: Panorama Template Push issue

jdelio — Thu, 02 Apr 2020 15:23:15 GMT

Hey there @a.jones ,

Normally that error message is because the exact same management IP to the both firewall is listed in the HA config.

Are you sure you have double checked both members to ensure that nothing is duplicated?

Also, ticking the option to sync the config is a good option as this ensures that the config is synced.

Re: Panorama Template Push issue

a.jones — Fri, 03 Apr 2020 10:39:35 GMT

Thanks for the response.

My setup is as follows for HA:

Palo 1:

Setup Section:

Peer HA1 IP Address

192.168.1.25

Backup Peer HA1 IP Address

192.168.1.17

Control Link:

Port	ha1-a
IPv4/IPv6 Address	192.168.1.26
Netmask	255.255.255.252

Control Link (HA1 Backup):

Port	management

Data Link (HA2):

Port	ethernet1/3
IPv4/IPv6 Address	192.168.1.34
Netmask	255.255.255.252

Management IP: 192.168.1.19

Palo 2:

Setup Section:

Peer HA1 IP Address

192.168.1.26

Backup Peer HA1 IP Address

192.168.1.19

Control Link:

Port	ha1-a
IPv4/IPv6 Address	192.168.1.25
Netmask	255.255.255.252

Control Link (HA1 Backup):

Port	management

Data Link (HA2):

Port	ethernet1/3
IPv4/IPv6 Address	192.168.1.33
Netmask	255.255.255.252

Management IP: 192.168.1.17

There is no duplication. Is it because the Backup Peer address is using the management address?

Regards

Adrian