Panorama | Unable to add subinterface

[Joshan_Lakhani]

iam facing below error while adding new sub-interface to our firewall – managed by panorama

[SutareMayur · Accepted solution]

@Joshan_Lakhani,

Try deleting the interface, push the config, re-create the interface, push template again.

Mayur

[Joshan_Lakhani]

subinterface  will show in firewall but not show at panorama.

[SutareMayur]

@Joshan_LakhaniIs sub-interface configuration done locally on gateway? I am just curious how configuration is pushed on gateway.

Mayur

[Joshan_Lakhani]

My Panorama Version is 8.1.7 i went to say when i create sub interface or zone  on panorama and import to firewall it generate this error

[SutareMayur]

@Joshan_LakhaniHave you tried to delete config on Panorama, pushed config and then reconfigure same.

Also look over here - https://live.paloaltonetworks.com/t5/General-Topics/Reference-not-valid-Panorama/td-p/116085

Mayur

[Joshan_Lakhani]

i have delete the subinterface from panorama and pushed the template and again reconfigure the interface but issue still same. Can you please tell me is there any bug in 8.1.7 b/c iam not able to see other Firewalls sub interface  on panorama 

[preston1 · Accepted solution]

i am also having this issue but i do not understand these instructions, can you please elaborate on them?

"Remove Panorama Settings (IP address and Don’t import anything)
Click OK
Edit it again and enable both Policy and Device objects.
Click OK
From Panorama, commit Device Group (including the new sub-interface)."

[preston1]

just for clarity the fix was to mirror the exact changes you make on panorama on the local firewall. so basically you push the same config you make twice, once each device. then they match up and you get a green sync again. it may be possible to get this to work from Panorama with the "push to devices" or "push to all" but i did not have any luck. Logging into the local firewall, making the changes, committing, the doing the same config again on panorama and committing did fix it.