Export or push device config bundle

[chens]

Hi

For some reason, after exporting from Panorama to PA440, using Export or push device config bundle.

The template is not being sent to the 440.

When can be the reason?

[TomYoung]

Hi @chens ,

This is something that is not explained very well in the documentation.

• Step 5 in the URL below, Export or push device config bundle, deletes the local Policies and Objects (device group configuration) and adds the Panorama pushed Policies and Objects.  Your template values are not changed.
• Step 6 in the URL below, Commit to Panorama then Commit > Push to Devices, will override the local Network and Device configuration (template values) IF the Force Template Values box is checked.  This should be done with care because you could override IP addresses, routes, etc.  The NGFW is smart enough not to change the management interface configuration or host name.  Generally this should be done only once on the first push after the export/push.

https://docs.paloaltonetworks.com/panorama/9-1/panorama-admin/manage-firewalls/transition-a-firewall...

Thanks,

Tom

[chens]

When i export the device config to the device, the commit fails because there are unknown zones. 

[TomYoung]

Hi @chens ,

Okay.  Your issue is a whole lot more than what you originally said.

1. Are you adding a new NGFW to Panorama?  The only time that you should do step 5 (Panorama > Setup > Operations > Export or push device config bundle) is when you are adding a new NGFW to Panorama and you want to import the standalone configuration.
2. If you are adding a standalone NGFW to Panorama, did you import the NGFW config into Panorama (step 4)?  If yes, then do NOT make any changes to the configuration before step 5.
3. If you are not adding a standalone NGFW to Panorama, then please do NOT use the term export.  It's just push.

Thanks,

Tom

[chens]

Hi

Yes, I am doing a new NGFW on-boarding to Panorama. Already played around with lab and now in production.

that's why I am exporting (and then "load device-state" in the NGFW). Pushing gives me the known duplication errors.

I think it happened because after i imported the NGFW into the Panorama, i have changed 3 zone names, that's why the commit failed. and after changing them manually (in the local NGFW) and tried to commit,  i had other errors like

"vsys -> vsys1 -> plugins unexpected here"
"vsys is invalid"

I thought the device-state contains the network\template info?, doesn't it?

[TomYoung]

Hi @chens ,

Okay.  Good.

You can delete the device group, template and template stack in Panorama and start the process again.  Since the commit failed on the NGFW, you should be able to load last saved configuration and start again.

This time do not make any changes before the push and export.

Also, the load device state is not required.

Follow the steps in the document, and you should be good to go!

Thanks,

Tom