Panorama Issue - cannot edit an interface on a template stack

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Panorama Issue - cannot edit an interface on a template stack

L1 Bithead

Hello guys,

 

first of all - I m new and I would like to apologize first of all, if the theat should have been opened wrongly, or my english should be a little bit **bleep** 😉

 

I cannot open/edit anything in a template stack under template->network->interface 

Zones and other things in the stack re working fine but if i click on a interface e.g. ethernet1/1 the window for the interface is popping up for some milli seconds and is closing directy.

Kai_Ulrich_2-1630591975261.png

 

I ve tested serval browsers on serval computers - restartet and updated panorama.

the editing on a template works well:

 

Kai_Ulrich_3-1630592073970.png

but not on a template stack (all stacks)

 

 

As panorama admin everything is working. The problem is only happen when I use a user with the type "Device Group and Template Admin"

 

 

 

 

 

I ve created a user with the type "Device Group and Template Admin" and one access domain and one admin role.

in the admin role i ve enables everything for the webui excluding panorama, save for other admins and commit for other admins but the network part is complety allowed.

Kai_Ulrich_1-1630591722430.png

 

The template and the stack re also included

Kai_Ulrich_5-1630592172593.png

 

I m using Panorama 10.0.7 (same problem was also with 10.0.6 and 10.0.5)

 

i couldn't find anything on the internet and just don't know what to do. i've been despairing about this problem for a very very long time. Maybe someone can help me , maybe it is a really stupid configuration issue. but i cannot find it. i played a lot with the rights but only as panorama admin it works in the stack.

 

Thanks a lot!

1 accepted solution

Accepted Solutions

L1 Bithead

Hello @PavelK ,

 

here the answer from Palo Alto:

 

I would like to update that we have been able to replicate this issue in our lab. It seems as if the concerned issue is only observed for the DG&T admin when SDWAN plugin is installed but not configured on Panorama.

We are discussing this internally if it requires another code change or the aforementioned change in 10.1.3 should be sufficient.

Meanwhile, since i see that the SDWAN is not configured on this Panorama, as a workaround we can remove the SDWAN plugin from this Panorama if acceptable.

I ve uninstalled the plugin and it works 🙂

View solution in original post

7 REPLIES 7

Cyber Elite
Cyber Elite

Hi @Kai_Ulrich 

 

thank you for reporting this issue.

 

By first look, your setup looks correct. Since you mentioned that window will open shortly and closes itself, would it be possible to run debug of Web UI and post the output here? Here is the link with instruction: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CmA9CAK

 

Kind Regards

Pavel

Help the community: Like helpful comments and mark solutions.

Hello @PavelK 

 

thank your for your support. I try serval times to paste the text here but i think it is to much and I could not post it.

So you can find the output here: 
https://cloud.saargummi.com/f/dda9e2c54c/?raw=1

 

Regards,

Kai

Cyber Elite
Cyber Elite

Thank you for reply @Kai_Ulrich only to confirm, was this debug run while login as a user with role: "Device Group and Template Admin"? I will try to reproduce it on my side.

 

 

Help the community: Like helpful comments and mark solutions.

Hello @PavelK 

 

yes, absolutly. I opened the debug page with my Panorama-Admin (because the effected user got no rights to open it)

And then i caused the error with the user in an incognito tab. I think it should all be included.

Unfortunately, I can understand the content of the output to little to confirm it. But i can repeat the procedure if it help or to be sure.

 

regards,

Kai

Cyber Elite
Cyber Elite

Thank you for reply @Kai_Ulrich and sorry for getting back to you with delay.

 

I was trying to reproduce the issue you are facing, however in all my attempts using exactly the same scenario it was working as expected. Based on your screen shots and description you provided it looks like there is no misconfiguration. I would advice to open a ticket to TAC or to your Palo Alto partner if you have such option.

 

Kind Regards

Pavel

Help the community: Like helpful comments and mark solutions.

Hellp @PavelK 

 

thank you very much for your effort!

I have opened a ticket and will post the result here as soon as i got feedback.

L1 Bithead

Hello @PavelK ,

 

here the answer from Palo Alto:

 

I would like to update that we have been able to replicate this issue in our lab. It seems as if the concerned issue is only observed for the DG&T admin when SDWAN plugin is installed but not configured on Panorama.

We are discussing this internally if it requires another code change or the aforementioned change in 10.1.3 should be sufficient.

Meanwhile, since i see that the SDWAN is not configured on this Panorama, as a workaround we can remove the SDWAN plugin from this Panorama if acceptable.

I ve uninstalled the plugin and it works 🙂

  • 1 accepted solution
  • 5694 Views
  • 7 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!