PA440 management interface doesn't take configuration

[${userLoginName}]

I used to think I knew how to do this stuff, but apparently not.  This is an out of the box configuration of a PA440 -

I set the firewall to configure system in standard mode and use static addressing.

Initial config

set deviceconfig system ip-address 192.168.1.1
set deviceconfig system netmask 255.255.255.0
set deviceconfig system update-server updates.paloaltonetworks.com
set deviceconfig system update-schedule threats recurring weekly day-of-week wednesday
set deviceconfig system update-schedule threats recurring weekly at 01:02
set deviceconfig system update-schedule threats recurring weekly action download-only........

Set system to access remotely on my network

set deviceconfig system ip-address 10.x.z.200
set deviceconfig system netmask 255.255.255.0

After commit

set deviceconfig system ip-address 10.x.z.200
set deviceconfig system netmask 255.255.255.0
set deviceconfig system update-server updates.paloaltonetworks.com
set deviceconfig system update-schedule threats recurring weekly day-of-week wednesday
set deviceconfig system update-schedule threats recurring weekly at 01:02.......

Show system info

hostname: PA-440
ip-address: unknown
netmask: unknown
default-gateway:
ip-assignment: static
ipv6-address: unknown
ipv6-link-local-address: unknown
ipv6-default-gateway.......

admin@PA-440> show interface management

Server error : op command for client dagger timed out as client is not available

admin@PA-440> show interface
  all          Show all interface information
  hardware     Show all hardware interface information
  logical      Show all logical interface information
  management   Show management interface information
  <value>      <name> interface name

Thanks for the help in advance.

[TomYoung]

Hi @${userLoginName} ,

This is the CLI config I send my customers:

admin/admin
set cli config-output-format set
configure

set deviceconfig system hostname HOSTNAME
set deviceconfig system type static
set deviceconfig system ip-address x.x.x.x
set deviceconfig system netmask 255.255.255.0
set deviceconfig system default-gateway x.x.x.x

set deviceconfig system dns-setting servers primary x.x.x.x
set deviceconfig system dns-setting servers secondary x.x.x.x
commit
exit
exit

Thanks,

Tom

[${userLoginName}]

Thank you for the reply - The management interface still isn't taking the address assignment.  I am still getting:

ip-address: unknown
netmask: unknown

when I do show system info.  The interface doesn't ping.  I am at a loss.

Thx for the help/

[Remo]

Hi @${userLoginName} 

Was the commit successful when you configured the IP address and other things? What PAN-OS version is installed on that box? Maybe a dumb question, but did you try to reboot the box already?

[pbalasunda]

May be you didn't disable ZTP?

[${userLoginName}]

Good questions - the commit was successful - no errors.  The OS is 10.1.0.  Yes, the box has been rebooted and connected to a known good interface on the switch.

[Remo]

... but even with ZTP still enabled the command show system info should not show "unknown" for the IP information

[${userLoginName}]

Is there a command line to turn off ZTP.  I told the device to use standard config when it was coming up.

[Remo]

After that, did you wait long enough (about 2-3 min) until you tried to configure the IP and started your commit?

[pbalasunda]

Please do,

> request disable-ztp

 to disable ztp.

To check status, run,

> show system info

and look for "zero-touch-provisioning"

[${userLoginName}]

yes - i believe so - I waited until the all the lights were green.

[${userLoginName}]

Is this bad?

admin@PA-Firewall> request disable-ztp

Server error : Not a supported operation on this platform

[Remo]

Yes it is. I recommend you to contact support by opening a TAC case.

[${userLoginName}]

admin@PA-Firewall> show system ztp status
Zero touch provisioning disabled by user

[Remo]

@${userLoginName} did you name your firewall manually "PA-Firewall"?