Export or push device config bundle

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Export or push device config bundle

L2 Linker

Hi

For some reason, after exporting from Panorama to PA440, using Export or push device config bundle.

The template is not being sent to the 440.

When can be the reason?

 

5 REPLIES 5

Cyber Elite
Cyber Elite

Hi @chens ,

 

This is something that is not explained very well in the documentation.

 

  • Step 5 in the URL below, Export or push device config bundle, deletes the local Policies and Objects (device group configuration) and adds the Panorama pushed Policies and Objects.  Your template values are not changed.
  • Step 6 in the URL below, Commit to Panorama then Commit > Push to Devices, will override the local Network and Device configuration (template values) IF the Force Template Values box is checked.  This should be done with care because you could override IP addresses, routes, etc.  The NGFW is smart enough not to change the management interface configuration or host name.  Generally this should be done only once on the first push after the export/push.

https://docs.paloaltonetworks.com/panorama/9-1/panorama-admin/manage-firewalls/transition-a-firewall...

 

Thanks,

 

Tom

Help the community: Like helpful comments and mark solutions.

When i export the device config to the device, the commit fails because there are unknown zones. 

Cyber Elite
Cyber Elite

Hi @chens ,

 

Okay.  Your issue is a whole lot more than what you originally said.

 

  1. Are you adding a new NGFW to Panorama?  The only time that you should do step 5 (Panorama > Setup > Operations > Export or push device config bundle) is when you are adding a new NGFW to Panorama and you want to import the standalone configuration.
  2. If you are adding a standalone NGFW to Panorama, did you import the NGFW config into Panorama (step 4)?  If yes, then do NOT make any changes to the configuration before step 5.
  3. If you are not adding a standalone NGFW to Panorama, then please do NOT use the term export.  It's just push.

Thanks,

 

Tom

Help the community: Like helpful comments and mark solutions.

Hi

Yes, I am doing a new NGFW on-boarding to Panorama. Already played around with lab and now in production.

that's why I am exporting (and then "load device-state" in the NGFW). Pushing gives me the known duplication errors.

I think it happened because after i imported the NGFW into the Panorama, i have changed 3 zone names, that's why the commit failed. and after changing them manually (in the local NGFW) and tried to commit,  i had other errors like

"vsys -> vsys1 -> plugins unexpected here"
"vsys is invalid"

 

I thought the device-state contains the network\template info?, doesn't it?

 

Cyber Elite
Cyber Elite

Hi @chens ,

 

Okay.  Good.

 

You can delete the device group, template and template stack in Panorama and start the process again.  Since the commit failed on the NGFW, you should be able to load last saved configuration and start again.

 

This time do not make any changes before the push and export.

 

Also, the load device state is not required.

 

Follow the steps in the document, and you should be good to go!

 

Thanks,

 

Tom

Help the community: Like helpful comments and mark solutions.
  • 1703 Views
  • 5 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!