Problem with export&push config to newly added firewall in panorama

[stef]

Hello,

We are trying to add new firewall to panorama . We follow the steps from the instruction for adding HA cluster to Panorama. But when we get to the step with export&push device config we get an error:

• Validation Error:
• plugins unexpected here
• vsys is invalid

Software version of panorama and firewalls is 11.0.1-h2

We tried several suggestions that we found in previous posts - uninstalling plugins on both panorama and firewalls,  restart management server process, load config and force commit etc. but there is no success. Same error.

Can you suggest what and were should we look at .

Thanks in advance!

[JayGolf]

Hi @stef ,

Are the firewalls you have multi-vsys by chance? I see a known issue with 11.0.1 PAN-225337.

[stef]

Hi @JayGolf,

the firewalls are pa-440 .  No multi vsys.

[tonyrobson]

I saw this issue when there was configuration in Shared in the network/device templates being pushed to single vsys firewalls, by moving all the configuration out of Shared it solved the issue.

The whole Shared/Multi-Vsys/Single-vsys  template management between Panorama and the firewalls is really very problematic in my experience, this is one error of many that I have encountered in this, what I'd give for a month to sit with the developers (if there are any left) of Panorama to fix the quality of life issues.

[stef]

Yes, we had such issues related to shared objects but we manage to fix/bypass them. The only think now is the error with the plugins.

I will open case with palo alto .

PS: "to fix the quality of life" we really need that in next version : )