Not able to delete Vsys1

[JMBerzal]

Hello,

We have a problem when trying to delete vsys1 from the FW. Customer enabled multi-vsys and they had two vsys configured. Right now, due to topology changes, vsys1 is no longer required so customer would like to delete that vsys. 

The thing is that the PaloAlto won't allow us to delete the vsys1 even tough we have double-checked that there are no more dependencies. I have even downloaded the XML and checked for vsys1 on the configuration, just to make sure that there is no any references to that vsys.

The error the PaloAlto throws is "1 - Failed to delete vsys - vsys1. vsys constraints failed: Cannot delete virtual system 'vsys1' "

Do you have any idea on how to further investigate this issue? Is it a bug?

Customer's affected FW is PA-5050 with version 8.1.21 

Thanks in advance,

Jose

[Metgatz · Accepted solution]

Hello @JMBerzal 

The Vsys1 can't be delete, it's a default vsys.

Check this links:

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/virtual-systems/configure-virtual-systems

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/virtual-systems/configure-virtual-systems#....

Cheers

[JMBerzal]

Hello @Metgatz 

Thanks for the help, I missed that chart on the administration guide. As customer wants to leave only one vsys can we use the expedition tool to move the configuration from vsys2 to vsys1 and delete the vsys2 afterwards?

Cheers,

Jose

[Metgatz]

Hello @JMBerzal 

Hello, I think it is possible, personally I have not done it, precisely what you want to do, but it is something that falls within the scope of Expedition.

https://live.paloaltonetworks.com/t5/expedition-discussions/expedition-tool-to-migrate-vsys/td-p/274...

Another way can be with Load partial:

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-cli-quick-start/use-the-cli/load-configurations/... partial-configuration-into-another-configuration-using-xpath-values#idc06fc1f6-6820-4985-b3c4-4664b900dfcd

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-cli-quick-start/use-the-cli/load-configurations/... formats-determined-by-device-configuration#id34238ccb-2aa0-43d7-a43a-034ee6adf695:~:text=XPATH%20FORMATS-,Multi%2Dvsys%20Firewall,-from%2Dxpath

As always and good practice, run backups

Cheers