Panorama 5.1 with fw PanOS 4.1.14

[paloalto.netfos]

Hello Everyone,

We deploy a panorama 5.1.4 and 2 fws are managed on it, one of the fws is running PanOs5.0.8 and another one is running 4.1.14. We can see the fws normally on Panorama -> Managed devices and Templates tabs. however when I finsh a ldap-server-profile template and click commit button and select the radio Template, I could not see the fw which runs 4.1.14, but another fw could.

I also see the document "PanoramaAdministratorsGuide_5.1.pdf", on the page 77, the tips as below.

For firewalls running PAN-OS 4.x, the use of Panorama templates is limited to the following:

• Creating response pages

• Defining authentication profiles and sequences

• Creating self-signed certificates on Panorama or importing certificates

• Creating client authentication certificates (known as Certificate Profiles in Panorama 5.0 and later)

• Creating server profiles: SNMP Trap, Syslog, Email, NetFlow, RADIUS, LDAP, and Kerberos

So I could not find the fw running PAN-OS 4.1.14, is the normal beheavy ?  or bug ? anyone knows that?

Thanks.

Joy

[pulukas]

Does the template have any of objects not supported in PanOS 4.1?

Perhaps including unsupported objects prevents the entire template from being allowed.

[paloalto.netfos]

Hello,

Thanks for your reply, but I am very sure that only the ldap server profile that I set including in the template.

Joy

[pulukas]

I would try creating a new template with just the ldap server profile and applying this to the PanOS4.1.14 firewall alone.

If this works add the 5.0.8 firewall and see if it goes.

I am thinking that perhaps you can't mix cross major revisions or that there is something corrupt in the original template that prevents the 4.1.14 commit.

[rmonvon · Accepted solution]

Devices running PAN-OS 4.1 or older does not support Template.  As Steven suggested, you can create a separate template for the 4.x devices and manage 4.x devices separately from the 5.0 devices.  You will need to issue a 'Device Group' commit and choose 'Include Device and Network Templates' to the 4.1 device.  Thanks.

[paloalto.netfos]

Hello,

Thanks for detaiil answers.

Joy