Error pushing templates from PANORAMA to PA850 device

[weezy]

Hi All,

I'm pushing the templates and variables from our panorama to our new device. The variables are correct and I keep getting an error that says 

• Validation Error:
• . network -> ike -> gateway -> PA-PA-EUR-GW -> local-address -> ip 'x.x.x.x/30' is not a valid reference
• . network -> ike -> gateway -> PA-PA-EUR-GW -> local-address -> ip is invalid
• . Warning: No Valid Threat License
• . Warning: Advance Routing mode is disabled , feature not supported
• . Error: tunnel PA-PA-EUR: local interface ethernet1/1 has no IP address configured
• . Error: tunnel configuration error
• . (Module: device)
• . client device phase 1 failure
• . Commit failed

When I check the variables the IP is there and as per our SR Net Engr , I just had to keep repeating pushing it until it push completely. I've been trying this since yesterday but no luck. Does the license issue of PANORAMA can affect this?

Thank you for your answers.

[mshekh]

Hi @weezy ,

As per error, it's related to configuration, I don't see any relation between license and this error. You can try with commit force once and check if commit force helps.

[PavelK · Accepted solution]

Hello @weezy

could you make sure that "Include Device and Network Templates" is selected when pushing configuration?

Kind Regards

Pavel

[weezy]

//could you make sure that "Include Device and Network Templates" is selected when pushing configuration?//

its always selected as well as the force template push and didn't fix the issue

[weezy]

//could you make sure that "Include Device and Network Templates" is selected when pushing configuration?//

its always selected as well as the force template push and didn't fix the issue

I'm working now with PA TAC and they are having a hard time to fix it.

[PavelK]

Hello @weezy

thank you for reply.

If TAC is already working on it, you are already in better hands, however only to share. For this kind of error, my next step would be looking into configd.log file (less mp-log configd.log). This file generally includes more details about error.

Kind Regards

Pavel

[weezy]

TAC didn't check the MPLOG but suggested to reset the FW instead.

[weezy]

This is fix now the PA TAC didn't install the AV and wildfire that is why we are getting an error "  destination 'panw-bulletproof-ip-list' is not an allowed keyword"

Our SR engr installed the update and then that fix the issue.