topic PA Cluster and Panorama Template in General Topics https://live.paloaltonetworks.com/t5/general-topics/pa-cluster-and-panorama-template/m-p/12110#M8881 <HTML><HEAD></HEAD><BODY><P>Hey</P><P></P><P>i am trying to understand how to use Pannorama with PA cluster</P><P>my view of panorama is: if you have pannorama you should never have to login to the PA itself for configuration.</P><P></P><P>right now i have one PA cluster and one pannorama server (the PA have a customer configuration on it)</P><P>i started playing and testing for what i will do so my steps where until now:</P><OL style="list-style-type: decimal;"><LI>Upgrade all the device software to the relevant software version</LI><LI>Verify the cluster is working and synced</LI><LI>Backup the two PA device</LI><LI> Add the PA serial number to the Panorama</LI><LI>Configure the PA device with the Panorama IP and <STRONG>commit</STRONG> configuration</LI><LI>Verify the PA had connected to the panorama server</LI><LI>Create a new template and add the two devices<UL><LI>Check the Group HA Peers</LI></UL></LI><LI>taking the users configur from the cluster and placing it inside the template throught the cli:<UL><LI>set mgt-config users </LI></UL></LI><LI>i played arround and verified that the templates are synced between the two PA and the pannorama</LI><LI>changing stuf commiting and checking and everything is fine EXCEPT:</LI><LI>i tried to change the password of one user and commit it only on one of the PA and what i have seen that the PA itself does not synchronizing the configuration to its peer, and that one is marked as synchronized and the other as out of sync</LI></OL><P></P><P>what i am having hard to understand is:</P><OL><LI>why on the template area at PA i cannot see the two PA device as one device (for example group HA Peers)?</LI><LI>why the configuration is really sent only to one device and does not synced to the other device?</LI><LI>after i overrite the configuration on the PA device with the template configuration i cannot see this configuration on the PA device previously where under: set mgt-config users</LI></OL></BODY></HTML> Sun, 29 Sep 2013 16:20:03 GMT minow 2013-09-29T16:20:03Z PA Cluster and Panorama Template https://live.paloaltonetworks.com/t5/general-topics/pa-cluster-and-panorama-template/m-p/12110#M8881 <HTML><HEAD></HEAD><BODY><P>Hey</P><P></P><P>i am trying to understand how to use Pannorama with PA cluster</P><P>my view of panorama is: if you have pannorama you should never have to login to the PA itself for configuration.</P><P></P><P>right now i have one PA cluster and one pannorama server (the PA have a customer configuration on it)</P><P>i started playing and testing for what i will do so my steps where until now:</P><OL style="list-style-type: decimal;"><LI>Upgrade all the device software to the relevant software version</LI><LI>Verify the cluster is working and synced</LI><LI>Backup the two PA device</LI><LI> Add the PA serial number to the Panorama</LI><LI>Configure the PA device with the Panorama IP and <STRONG>commit</STRONG> configuration</LI><LI>Verify the PA had connected to the panorama server</LI><LI>Create a new template and add the two devices<UL><LI>Check the Group HA Peers</LI></UL></LI><LI>taking the users configur from the cluster and placing it inside the template throught the cli:<UL><LI>set mgt-config users </LI></UL></LI><LI>i played arround and verified that the templates are synced between the two PA and the pannorama</LI><LI>changing stuf commiting and checking and everything is fine EXCEPT:</LI><LI>i tried to change the password of one user and commit it only on one of the PA and what i have seen that the PA itself does not synchronizing the configuration to its peer, and that one is marked as synchronized and the other as out of sync</LI></OL><P></P><P>what i am having hard to understand is:</P><OL><LI>why on the template area at PA i cannot see the two PA device as one device (for example group HA Peers)?</LI><LI>why the configuration is really sent only to one device and does not synced to the other device?</LI><LI>after i overrite the configuration on the PA device with the template configuration i cannot see this configuration on the PA device previously where under: set mgt-config users</LI></OL></BODY></HTML> Sun, 29 Sep 2013 16:20:03 GMT https://live.paloaltonetworks.com/t5/general-topics/pa-cluster-and-panorama-template/m-p/12110#M8881 minow 2013-09-29T16:20:03Z Re: PA Cluster and Panorama Template https://live.paloaltonetworks.com/t5/general-topics/pa-cluster-and-panorama-template/m-p/12111#M8882 <HTML><HEAD></HEAD><BODY><P>also i have seen that when i commit the template only on one device the the other peer turns into not functional but the runnig config is still shown as synchronized, and also when i do commit the template on both of the device the state of the non-functional device must be manually chaged throught the CLI</P><P></P><P>and also when i commit the template on both of the device at once after the commit on both of them is finished on is becoming non-functional</P></BODY></HTML> Sun, 29 Sep 2013 16:36:42 GMT https://live.paloaltonetworks.com/t5/general-topics/pa-cluster-and-panorama-template/m-p/12111#M8882 minow 2013-09-29T16:36:42Z