07-02-2023 07:13 AM
Last week we lost one of our sites Acitve/Passive firewalls. An event appeared to happen, that caused the firewalls to try a failover. However the failover failed, and the firewalls were in a "hung" state. When I had smart hands plug into the MGT port, I was able to get into the GUI. The ports all showed "down"(or gray). Previous admins set the network interface IP addresses, NAT policies, and other settings using names objects. The firewall logs showed "invalid reference" errors on these settings(like NAT, and interface). So I wanted to go into NAT, and the interface IP settings, and change them directly to IP to get rid of the invalid reference errors. This didn't work. I couldn't override the Panorama mgmt. The override option was also grayed out. Was curious if anyone had any suggestions? I have opened a case, with Palo, for next week. Thanks for all of your help!
07-02-2023 08:14 AM
It kind of sounds like you were logged into the device with an account that wasn't a Superuser. Can you verify what permissions you actually have on the local firewall.
07-02-2023 09:30 AM
Thank you for your reply! The account is the super user account(local account since we can’t AAA due to the firewalls not having network connectivity). It seems there’s some kind of lock from panorama.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
