Panorama 9x - how to delete Child DG ObjectX if Parent ObjectX exists

rolinger — Wed, 29 Jul 2020 16:44:10 GMT

In Panorama 9x (specifically 9.0.6) if `Object-X` exits in both the Parent DG and a Child DG - you cannot delete the Child DG `Object-X`. In the Child-DG, the "delete" button for that object is grayed out. In the Parent-DG the delete button is available. But we need to delete the more specific Child-DG object in order to only have the more global Parent-DG object.

In the Child DG, you can revert the Child Object-X back to using the Parent level Object. But when you do that, `Object-X` now shows the location as Parent-DB and you no longer have access to the Child-DG Object-X - it is removed from the view.

So how do you actually delete the Child-DG Object-X ?

The answer is from CLI - `panorama# delete device-group DCE-vSys-Corp profiles virus Corp-Antivirus`

With the GUI open, you will see the Child-DG refresh itself and now show the Parent-DG Object - and the 'override' button will now be disabled because the Child-DG object no longer exists (thus nothing to override).

But, there are a few issues with this:

1. The biggest one: you have do delete each object one at a time. Since you can't delete these Child-DG objects from the GUI by selecting on 10, 20, 100 at a time, you have to do them one at a time via CLI

2. The Child-DG Object MUST be over-riding the Parent-DG object. If at the Child-DG level you `revert` to using the Parent-DG Object, than that Object does not appear in the Child-DG CLI list. If you don't see it, you must "override" the Parent-DG object and then it should appear again at which time you can delete it.

OK. So discovering this was a pain in the butt. BBUUTT....is this the only way to delete a Child-DG Object that is duplicated at a Parent-DG level??? We have hundreds of Child-DG level objects that need to be deleted in favor of an Ancestor Object of the same name....deleting them via cli one at a time is simply not realistic.

Re: Panorama 9x - how to delete Child DG ObjectX if Parent ObjectX exists

Remo — Sat, 01 Aug 2020 09:24:46 GMT

Hi @rolinger

"In the Child DG, you can revert the Child Object-X back to using the Parent level Object. But when you do that, `Object-X` now shows the location as Parent-DB and you no longer have access to the Child-DG Object-X - it is removed from the view." --> the object actually isn't only removed from the view, this step removed the object from the child-DG. So in this case should be possible to to select the objects you want to revert and then revert them.

If you need to revert hundrets/all child objects there is also the API with which you could write a small script that fetches all child objects and then delets/reverts them.

Another way with the CLI - requires a list of the objects that need to be deleted which could be also optained by showing the config on CLI - is to prepare all delete commands in a texteditor and then paste them at once in CLI.

topic Panorama 9x - how to delete Child DG ObjectX if Parent ObjectX exists in General Topics

Panorama 9x - how to delete Child DG ObjectX if Parent ObjectX exists

Re: Panorama 9x - how to delete Child DG ObjectX if Parent ObjectX exists