Impossible to commit: template values of parent template are present in template stack, but not pushed to the firewall

[SomeSuch]

Hello

my frustration level with panorama is reaching impossible levels so I really hope that someone can help me out.

Unfortunately I made the mistake of purchasing Pano with partner support and I can't open a case directly with PAN, and vendor support is horrible.

Long story short, Panorama is not pushing template values to newly added firewalls.

I have a "CommonTemplate" where I put template values that I want all firewalls to have.

This template is linked first.

I can see the new firewall's template stack showing values from this parent template.

But then the values are not pushed to the local machine.

Both objects and template values from Pano are of course enabled.

But when I export the config bundle, or when I push a commit with Force Template Values, those values are missing from the candidate config on the local firewall, and the commit fails. Template values in the firewall's specific template are not pushed either. load device-state was done from CLI, no values present.

Both Pano and the FW are on 10.2.4-h3.

Any help would be very much appreciated.

I have to say, combined with the 410's lack of logging over a spotty 3g connection, this has been one of the most infuriating experiences in my networking career. What a terrible device the 410 is and what an awful system Panorama templates are.

[PavelK]

Hello @SomeSuch

would it be possible to share details of failure you got when pushing configuration to PA-410? If the error is not self explanatory, could you check logs from CLI:

Panorama: tail follow yes mp-log configd.log

FW: tail follow yes mp-log devsrv.log

These logs will usually give more information to troubleshoot the issue.

Kind Regards

Pavel

[ozheng]

Hello @SomeSuch ,

You do the push from Panorama, you open the task manager on the PA-410 and you should see the commit job.
If the commit is failing, you should see the error.
If the commit is not failing, maybe you can do a "force template" (WARNING : that would override the local configuration with the config from Panorama).