Panorama Issue - cannot edit an interface on a template stack

[Kai_Ulrich]

Hello guys,

first of all - I m new and I would like to apologize first of all, if the theat should have been opened wrongly, or my english should be a little bit **bleep** 😉

I cannot open/edit anything in a template stack under template->network->interface 

Zones and other things in the stack re working fine but if i click on a interface e.g. ethernet1/1 the window for the interface is popping up for some milli seconds and is closing directy.

I ve tested serval browsers on serval computers - restartet and updated panorama.

the editing on a template works well:

but not on a template stack (all stacks)

As panorama admin everything is working. The problem is only happen when I use a user with the type "Device Group and Template Admin"

I ve created a user with the type "Device Group and Template Admin" and one access domain and one admin role.

in the admin role i ve enables everything for the webui excluding panorama, save for other admins and commit for other admins but the network part is complety allowed.

The template and the stack re also included

I m using Panorama 10.0.7 (same problem was also with 10.0.6 and 10.0.5)

i couldn't find anything on the internet and just don't know what to do. i've been despairing about this problem for a very very long time. Maybe someone can help me , maybe it is a really stupid configuration issue. but i cannot find it. i played a lot with the rights but only as panorama admin it works in the stack.

Thanks a lot!

[PavelK]

Hi @Kai_Ulrich 

thank you for reporting this issue.

By first look, your setup looks correct. Since you mentioned that window will open shortly and closes itself, would it be possible to run debug of Web UI and post the output here? Here is the link with instruction: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CmA9CAK

Kind Regards

Pavel

[Kai_Ulrich]

Hello @PavelK 

thank your for your support. I try serval times to paste the text here but i think it is to much and I could not post it.

So you can find the output here: 
https://cloud.saargummi.com/f/dda9e2c54c/?raw=1

Regards,

Kai

[PavelK]

Thank you for reply @Kai_Ulrich only to confirm, was this debug run while login as a user with role: "Device Group and Template Admin"? I will try to reproduce it on my side.

[Kai_Ulrich]

Hello @PavelK 

yes, absolutly. I opened the debug page with my Panorama-Admin (because the effected user got no rights to open it)

And then i caused the error with the user in an incognito tab. I think it should all be included.

Unfortunately, I can understand the content of the output to little to confirm it. But i can repeat the procedure if it help or to be sure.

regards,

Kai

[PavelK]

Thank you for reply @Kai_Ulrich and sorry for getting back to you with delay.

I was trying to reproduce the issue you are facing, however in all my attempts using exactly the same scenario it was working as expected. Based on your screen shots and description you provided it looks like there is no misconfiguration. I would advice to open a ticket to TAC or to your Palo Alto partner if you have such option.

Kind Regards

Pavel

[Kai_Ulrich]

Hellp @PavelK 

thank you very much for your effort!

I have opened a ticket and will post the result here as soon as i got feedback.

[Kai_Ulrich · Accepted solution]

Hello @PavelK ,

here the answer from Palo Alto:

I would like to update that we have been able to replicate this issue in our lab. It seems as if the concerned issue is only observed for the DG&T admin when SDWAN plugin is installed but not configured on Panorama.

We are discussing this internally if it requires another code change or the aforementioned change in 10.1.3 should be sufficient.

Meanwhile, since i see that the SDWAN is not configured on this Panorama, as a workaround we can remove the SDWAN plugin from this Panorama if acceptable.

---

I ve uninstalled the plugin and it works 🙂