Panorama Template Push issue

Reply
Highlighted
L3 Networker

Panorama Template Push issue

Hi All,

 

I have an issue with a Template push to device issue.

 

I have added some routes in the BGP import section and have committed to Panorama without issue. When I push to device I run into a couple of separate issues which is causing me problems.

 

When I push to devices using the force template values I get issues concerning HA and this error: ha1-backup interface ipaddr configured to match peer-ip-backup address

 

My setup is an active passive pair with unique management addresses, unique hostnames.

 

HA is configured with unique IPs for Peer HA1 on both, pointing to the IP set on Control Link HA IP set on the opposite device. The backup HA is configured to work on the management interface and the peer set to opposite device IP.

 

If I don't force template it is all okay, and it works apart from the config is not pushed.

 

If I force the template, the passive device fails with the error above but the primary device has the config on.

 

Question is how to resolve this through Panorama? If it can't, is it best to do this config on the device and is that achieved by selecting the "Disable Device and Network Template" in Device>Setup>Panorama settings?

 

Secondary quicky question - is it best to have sync config ticked post migration to Panorama as the documentation wasn't clear whether to enable it or not?

 

Regards

 

Adrian

Community Team Member

Hey there @a.jones , 

Normally that error message is because the exact same management IP to the both firewall is listed in the HA config. 

Are you sure you have double checked both members to ensure that nothing is duplicated?

 

Also, ticking the option to sync the config is a good option as this ensures that the config is synced. 

Stay Secure,
Joe
End of line
Highlighted
L3 Networker

Thanks for the response.

 

My setup is as follows for HA:

 

Palo 1:

Setup Section:

Peer HA1 IP Address
192.168.1.25
Backup Peer HA1 IP Address
192.168.1.17

Control Link:

Port
ha1-a
IPv4/IPv6 Address
192.168.1.26
Netmask
255.255.255.252

Control Link (HA1 Backup):

Port
management

Data Link (HA2):

Port
ethernet1/3
IPv4/IPv6 Address
192.168.1.34
Netmask
255.255.255.252

Management IP: 192.168.1.19

 

Palo 2:

Setup Section:

Peer HA1 IP Address
192.168.1.26
Backup Peer HA1 IP Address
192.168.1.19

Control Link:

Port
ha1-a
IPv4/IPv6 Address
192.168.1.25
Netmask
255.255.255.252

Control Link (HA1 Backup):

Port
management

Data Link (HA2):

Port
ethernet1/3
IPv4/IPv6 Address
192.168.1.33
Netmask
255.255.255.252

Management IP: 192.168.1.17

 

There is no duplication. Is it because the Backup Peer address is using the management address?

 

Regards

 

Adrian

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!