06-10-2026 09:57 PM
Quite new to Panorama, but have been working with Palo Alto standalone firewalls for a little while.
Client has 2 Active Passive HA FW's in Panorama and an ae1 interface with 4x 1G interfaces as members.
They want to switch this to 4x of the 10G interfaces during an outage window.
Am I right that I should be able to just remove the 4x 1G members, add the 4x 10G members in the template in panorama and the commit to the devices?
Client seems to think that this isn't possible, they read somewhere Panorama wont allow it - apparently some sort of order of operations issue where it wont work due to the mixed speeds, though at no point would we have a mix of interfaces at the same time, but they can't find where they read the supposed article. They believe an export, manual config edit and import is the only way...
Has anyone done this exact change and can confirm ?
06-13-2026 10:13 PM
Hello @J.Morgan425685
thank you for posting!
Unfortunately, I have not done this exact the same operation before, so I can't speak for my own experience, however I spent some time to go through KB articles and documentation. I did not come across any article that reassembles concern of your customer. While there are some limitations what can be configured with AE interfaces from Panorama:
Push from Panorama to Firewall fails due to invalid configuration - poe is invalid. Not a PoE port
this operation is fully supported: Configure an Aggregate Interface Group. Especially taking into consideration your customer will arrange maintenance window, I do not see any blocker. If you get an error while committing or pushing configuration to managed Firewall, I would start troubleshooting here based on actual error. In the case you run into an issue with configuration / pushing errors, below commands are helpful to drill down the issue:
Panorama side: mp-log configd.log
Firewall side: mp-log devsrv.log
Kind Regards
Pavel
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
