Failed to commit policy to device after downgrading 10.0.0

[Momoj]

Hi All,

We are trying to downgrade from 10.0.6 to 9.1.15. After we downgrade to 10.0.0 first , the auto commit have error. It mention failed to commit policy to device. Do anyone have go through the same problem? My suggestion is we just downgrade to 9.1.15 since we already in base version 10.0.

[TomYoung]

Hi @Momoj ,

In my experience, this happens occasionally if the firewall does not convert the configuration correctly between versions.  If you open the task manager and look at the details for the auto-commit, you should be able to see the exact commit error so that you can fix it.  It usually is a syntax error that can be fixed in the GUI or the CLI by adding or removing a specific parameter or just deleting and re-adding the specific piece of configuration.

My guess is that you will get the same auto-commit error in 9.1.15.  So, I would fix it.

Thanks,

Tom

[Momoj]

Hi @TomYoung,

Alright, I understand. I already take a look at the details for auto commit. Its only mention failed to commit policy to device and I also can see some warning related to certificate( Eg. is configured with no certificate profile. Please select a certificate profile for performing server certificate validation)

[TomYoung]

Hi @Momoj ,

I understand.  An auto commit failure with no error message is very difficult to troubleshoot. 

Normally warnings do not impact the commit, but I ran across this doc -> https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PPRPCA4&lang=en_US%E2%80%A... with the same error that you have (different warning).  That solution was to fix the warning.  The only time I have seen a certificate profile warning is for EDLs -> https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLdlCAG, and these warnings normally do not cause the commit to fail.

I also see that auto commits can fail due to bugs, dynamic update mismatches, etc.  So, it may not be a config issue.

1. Try a "commit force" on the CLI to see if it fixes it.
2. Open a TAC case.

If you still feel like doing it on your own, you could remove the config with the warning and commit force or look through the ms.log file to see if you can find the reason for the commit failure -> https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PMb2CAG.

Sorry that I can't provide a quick fix,

Tom