PA 850 ETH1/1 disabled

[weezy]

Need your help we setup a new PA850 to replace our PRIMARY FW in EUR. Now the config has been push to the device however, i'm seeing the eth1/1 is disabled for some reason.

Is there a command that I can forcefully enable it? even on GUI it shows RED status.

I tried to disabled or re-enable it on CLI and I got this error 

set failed, may need to override template object ethernet1/1 first

[mshekh]

Hi @weezy ,

Thanks for info, Looks like configuration has been pushed from panorama.  if you are enforcing the config from panorama then you can make the changes at panorama template or you can override the config locally at firewall and then make necessary changes as per your requirement. 

ukn/ukn/down(power-down) is when you set the Link-State to Disable

disabled/down: You've disabled the interface. 

forced/ukn: You've forced the speed/duplex setting and the status of the interface is unknown. Usually caused by unsupported SFPs or if you statically set the link-state to up but the interface is unplugged. 

forced/down: You've forced the speed/duplex settings and the interface is down. 

[reaper]

@weezy Did you remember to disable ZTP mode after the first boot?

by default new devices boot up in ZTP mode which reserves interface 1/1 for ZTP. this will also block it from being used for anything else

you can disable that using the following command:

set system ztp disable 

after a reboot you should be good to go

[weezy]

Our SR. Engr check it and he said that the device on the other end which is cisco core switch interface is on error disabled state so he bounce it and he said that it was up now. 

is that also possible too?

[weezy]

after I disable ZTP mode, can I reboot the PA?

[reaper]

yes, reboot is required when you disable ZTP