For the last few days, we have been trying to import firewalls into Panorama and have not been successful at it.
Panorama firmware is 9.0.7
Palo Alto firmware: 8.1.13
Description of issue: During the importing process, I was able to extract the configs from PA firewall onto the Panorama. However, when I tried to commit the configs back to PA firewall from Panorama. The commit would fail, and the reason for the failure is because there’s missing IP addresses in ‘Objects’.
Following is the commit error
rulebase -> nat -> rules -> AESG-DNAT-P157-2 -> destination 'Host_126.96.36.199-32' is not an allowed keyword
rulebase -> nat -> rules -> AESG-DNAT-P157-2 -> destination Host_188.8.131.52-32 is an invalid ipv4/v6 address
rulebase -> nat -> rules -> AESG-DNAT-P157-2 -> destination Host_184.108.40.206-32 invalid range start IP
rulebase -> nat -> rules -> AESG-DNAT-P157-2 -> destination 'Host_220.127.116.11-32' is not a valid reference
rulebase -> nat -> rules -> AESG-DNAT-P157-2 -> destination is invalid
Error: Failed to find address 'Host_18.104.22.168-32'
Error: Unknown address 'Host_22.214.171.124-32'
Error: Failed to parse nat policy
GlobalProtect App Dynamic Configuration misses information for 'show-system-tray-notifications'.
it seems like the problem is with the missing objects during the importing process. As an example, the total amount of addresses on the firewall is 490. However, we can only see 460 after the configs have been copied over from Panorama to the firewall.
We have also tried adding Host_126.96.36.199-32' manually to panorama as a shared object but still cannot commit
we did upgrade our Panorama firmware recently from 9.0.4 --- > 9.0.7. And our firewall firmware from 8.0.13 -> 8.1.13
Push the templates first, then push the policy
(Also please don't put your subject in all caps, this is a professional forum
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!