Disabled rules on Panorama being pushed to firewall

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Disabled rules on Panorama being pushed to firewall

L0 Member

Hi All, 

 

I had a very strange behavior recently on panorama. Disabled rules don't go to firewalls when a push is performed from Panorama, but I had a disabled rule on panorama which got pushed to firewalls. Please find below events in the order they appeared.

 

1. I had disabled a Security Rule and 2 PBF rules on Panorama and pushed the config to firewalls. It was pushed successfully, and I couldn't see disabled rules on the local firewall, which is expected behavior.

2. I had to configure a security rule on same Device Group to allow some traffic and it was pushed successfully onto the local firewall.

3. When I checked the local firewall after the last push, I found that along with the new rule, the disabled rule and 2 PBFs were also pushed, but when I checked back on Panorama, they were still showing disabled and there were no pending changes to commit.

 

If anybody has come across such behavior or know anything about it, your help will be much appreciated.

 

Panorama NGFW 

2 REPLIES 2

Community Team Member

Hi @SCH-Gaurav ,

 

I haven't encountered this in the past, but if you enable and disable the appropriate policies in Panorama and then push them out, do they still appear on the managed firewall?

LIVEcommunity team member
Stay Secure,
Jay
Don't forget to Like items if a post is helpful to you!

Please help out other users and “Accept as Solution” if a post helps solve your problem !

Read more about how and why to accept solutions.

Cyber Elite
Cyber Elite

Hello @SCH-Gaurav

 

could you confirm what PAN-OS version you are running on Panorama? If you are running PAN-OS 10.2, you might be running into bugs addressed in PAN-OS 10.2.8:

 

PAN-240197
Fixed an issue where configuration changes made in Panorama and pushed to the firewall weren’t reflected on the firewall.

 

PAN-208438
Fixed an issue on Panorama where Security policy rules incorrectly displayed as disabled.

 

Kind Regards

Pavel

Help the community: Like helpful comments and mark solutions.
  • 411 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!