How to Delete the Default VWire Configuration Using a Forced Panorama Template

Overview

This document describes how to delete the default configuration of a Palo Alto Networks firewall using a forced Panorama template. A Palo Alto Networks firewall is preconfigured with a default Virtual Wire (vwire) configuration using the ethernet1/1 and ethernet1/2 interfaces. The following examples show the default vwire configuration:

Steps

1. On the managed firewall, delete the default-vwire configuration under Network > Virtual Wires.
   
   
   
2. Under the template configuration in Panorama, configure the ethernet1/1 and ethernet1/2 as Layer3.  Assign zones, respectively.
   
   
   
3. Keep the Virtual Wires section empty in the same template
   
   
   
4. Commit the configuration on the firewall from the Panorama with the 'Force Template Values' option checked.
   
   
   
5. The commit should be successful and the interfaces on the firewall should now be changed to Layer3.
   

Warning: If the default-vwire configuration on the firewall is not deleted (step 1 above) before the Panorama push, the commit fails with the following error:

owner: kadak