Firewall Config Templates(network) not showing up in Panorama

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Firewall Config Templates(network) not showing up in Panorama

L2 Linker

Yesterday we had to reboot one of our firewalls that is managed by the panorama. After the reboot, we noticed that half the config is no longer showing in the panorama. Everything appears to be ok locally on the firewall (panorama pushed config and interfaces) but it doesn't look like it's being managed by panorama anymore.

 

Even though in panorama the firewall shows connected and the commit/push to devices is successful. We tried restarting the mgmt server process on the Panorama but with no success.

Though the firewall shows connected we do not see any logs being forwarded from the firewall even though we have Log Settings on the firewall to forward all the logs to Panorama. We also do not see "SC3" error under ms.log on the firewall.

 

We can see commit on the firewall is also successful when pushed from Panorama. Still, we do not see anything under Interfaces/Zones in Template on Panorama but after the successful push, on Firewall we see all the Policies created in Panorama and all the interfaces correctly. This was working before the reboot and since we rebooted we noticed this issue.

 

We are trying to figure out how to get the full config of the firewall back in panorama. Is there a way we can re-add the template configuration from the firewall back on Panoarama without loosing anything?

Thanks for help.

1 REPLY 1

L2 Linker

Can we do the import following below steps:

 

  1. On the firewall, remove the Panorama settings by going to Device > Setup, and edit the Panorama Settings, remove the Panorama configuration. Most Important store when Disabling the Panorama Policy and Device Network template IMPORT these settings on the firewall so that we do not have to redo any configuration again. Check the configuration box below.

 

UtkarshKumar_0-1677899419867.png

 

 

  1. Import Panorama Policy and Objects before disabling and Import Device and Network Template before disabling. This will store all the config locally on firewall and then perform Commit.
  2. We would need to remove the Firewall from Panorama Managed Devices and follow step-by-step process highlighted in : https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cmd6CAC
  3. In the above step we will also remove the Device Group and Template settings so as to avoid data duplication and corruption.
  4. When the device is removed from Panorama and is being locally managed, we would start the process to reimport the device in Panorama.
  5. The step-by-step guide to reimport the firewall is at https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CloRCAS
  6. Once we add the device in Managed devices we can reimport the device configuration on Panorama completely and after checking all the configuration is back from firewall, to manage this from Panorama we will do  'Export or push device config bundle'.
  7. The device will be back in Panorama with all the configuration.
  • 2198 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!