New Panorama migration - commit error when completing

[a.jones]

Hi All,

I have just migrated an active/passive pair of 5220's to Panorama. After completing this following https://docs.paloaltonetworks.com/panorama/8-1/panorama-admin/manage-firewalls/transition-a-firewall... I go to perform step 4 and I get an error which I can't seem to resolve. Can someone help?

Here is the error:

devices -> localhost.localdomain -> template-stack -> mll.pa.fw0.eastnet_stack -> config -> devices -> localhost.localdomain -> deviceconfig -> system -> route -> service -> crl-status -> source is missing 'address'
devices -> localhost.localdomain -> template-stack -> mll.pa.fw0.eastnet_stack -> config -> devices -> localhost.localdomain -> deviceconfig -> system -> route -> service -> crl-status -> source is invalid

Its stopping me in the final stages of deployment.

Regards

Adrian

[Remo · Accepted solution]

Hi @a.jones 

According to this error, did you check the service route config? Is there an address configured for CRL status configured or actually should there be one? Maybe you can sove that by manually changing it or then try to delete this, commit and then try to configure it again.

[a.jones]

@Remothanks. Checked that and found the root cause. It now commits.

Regards

Adrian

[MDroyKT]

Hello,

I'm having almost the same error:

• Validation Error:
• devices -> localhost.localdomain -> template-stack -> SEIT-PA-220-LAB-FW_stack -> config -> devices -> localhost.localdomain -> deviceconfig -> system -> route -> destination -> 10.0.128.100 -> source is missing 'address'
• devices -> localhost.localdomain -> template-stack -> SEIT-PA-220-LAB-FW_stack -> config -> devices -> localhost.localdomain -> deviceconfig -> system -> route -> destination -> 10.0.128.100 -> source is invalid

But this happens even when I just try to commit it to Panorama, not only Commit and Push. This makes me think that the issue is somewhere in the Panorama configuration? I am unsure of where the issue lies exactly. I didn't think you could create service routes in Panorama, and in the firewall that I'm trying to migrate I added a source IP for the Panorama service route but still get the same error. I also tried just changing the service route to "Use Management Interface for All" but that didn't fix it either.

Any ideas from the error message on where I should check?

Thank you!

[PavelK]

Hello @MDroyKT

to me it looks like that the issue in your Template is under: Customize > Destination:

What would you like to achieve with the IP address: 10.0.128.100?

If you do not need service route based on destination, I would just delete it, then you should not be getting the commit error. If you want to force Firewall to communicate with Panorama through one of the data plane interfaces, you can use below setting:

Kind Regards

Pavel

[MDroyKT]

Got it! I just set all the service routes back to "Use default".

Thank you!!