topic Problem with Panorama pushed updates in General Topics

Problem with Panorama pushed updates

stef — Sun, 13 Dec 2020 16:43:07 GMT

Hello all,

i have problems with the security policy push.

When i try to push them the commits fails with :

. Validation Error:
. rulebase -> security -> rules -> ms-ad -> destination 'offices-subnet' is not an allowed keyword
. rulebase -> security -> rules -> ms-ad -> destination offices-subnet is an invalid ipv4/v6 address
. rulebase -> security -> rules -> ms-ad -> destination offices-subnet invalid range start IP
. rulebase -> security -> rules -> ms-ad -> destination 'offices-subnet' is not a valid reference
. rulebase -> security -> rules -> ms-ad -> destination is invalid
. vsys1
. Error: Failed to find address 'offices-subnet'
. Error: Unknown address 'offices-subnet'
. Error: Failed to parse security policy
. (Module: device)
. Commit failed

it happens with all shared addresses and address-groups. when i remove them, i mean when i push the polices without source/destination address configured, the commit is completed.

Re: Problem with Panorama pushed updates

SureshReddyM — Sun, 13 Dec 2020 18:39:49 GMT

Hi,

As per below logs I can assume that IP address /subnets were not properly defined or binded or might be wrong IPs

Best Regards,

Suresh

Re: Problem with Panorama pushed updates

stef — Sun, 13 Dec 2020 19:01:49 GMT

if it was just one address ok , but there is 1000+ records.

They used to worked before.

Re: Problem with Panorama pushed updates

Retired Member — Sun, 13 Dec 2020 20:06:42 GMT

Did it all of a sudden stop working or is this a new implementation or upgrade?

One thing to look for is that on the local firewall Panorama is allowed to push Objects:

As you're stating a blank push of a firewall policy without objects is working I believe this is enabled.

Make sure the Object or Object-Group you're trying to push out isn't bound to a certain firewall but is in the "Shared" object space or Object specifically for that FW.

If the item is a group containing more IP's, FQDN's or Objects it never hurts to check if the actually sub-objects for errors.

Re: Problem with Panorama pushed updates

stef — Sun, 13 Dec 2020 20:44:28 GMT

They are all shared.

If i create new shared one and push it it is work .

Re: Problem with Panorama pushed updates

BPry — Mon, 14 Dec 2020 05:05:22 GMT

@stef,

Is the offices-subnet the only object that you are having an issue with, or is it all of your address and address-group objects? It's not entirely clear from your earlier posts, but I'm assuming that this object is an address-group made up of a bunch of different address objects representative of all of your individual offices. When the commits started to fail, have you logged at the system logs and verified that nobody added in a new range that invalidated the entry? The error in your first post would indicate that someone simply fat fingered an IP address.

Re: Problem with Panorama pushed updates

stef — Mon, 14 Dec 2020 05:49:31 GMT

@BPry

this is only the example. It is address not address set . But the problem is with all other addresses and address-groups to

For example if i remove "offices-subnet" witch is configured as source subnet the error appear for the destination one witch is different and when i remove the destination one the error appear for the source object of the next policy, and so on and so on.

If i create new address-group or address and populate it in the policy there is no problem.

Re: Problem with Panorama pushed updates

Retired Member — Mon, 14 Dec 2020 20:04:03 GMT

How were the object created initially? The way you're explaining it sounds to me like an import gone wrong where the firewall/Panorama did load the Object but something is "off" with the way it's in the running XML.

Re: Problem with Panorama pushed updates

Retired Member — Mon, 14 Dec 2020 20:06:26 GMT

Another quick thought would be a Panorama running a newer version and using features that are not supported on the firewall you're pushing it to.

Re: Problem with Panorama pushed updates

stef — Mon, 14 Dec 2020 21:38:48 GMT

I import them via cli.

They used to work

Re: Problem with Panorama pushed updates

stef — Tue, 22 Dec 2020 08:53:30 GMT

Hello,

updating panorama to 9.1.6 and Restart configd daemon fixed the issue .

Thank you all