Panorama changes after static route added

[QGCNetworks]

We have added a static route to our Palo firewall through Panorama GUI and before committing the change when we compare the candidate config to running config it shows removal of some static route metrics for all static routes, even though we only added one new route.

We have added routes in the past and this has not happened.

We don't think this will affect the operation of the firewall as it is config we don't make use of anyway.

The new static route does not have this config either.

We suspect an update to Panorama has caused removal of this config if not used.

Curious if others have experienced the same ?

Removed config :-

path-monitor {
 enable no;
 failure-condition any;
 hold-time 2;

}

[kiwi]

Hi @QGCNetworks 

Yes this is expected behavior.  

Palo Alto Networks changed how the configuration for path monitoring on static routes is handled to reduce the size of the configuration. In older versions of PAN-OS, the firewall would explicitly show a path-monitor section for every static route, even if it was disabled.

In more recent versions of PAN-OS, this explicit, non-functional configuration is no longer stored in the running config if it's not in use. When you make a change to a static route via Panorama and commit, the system recognizes that this default configuration is unnecessary. It then removes the explicit path-monitor section from all existing static routes, as it's no longer required by the new configuration standard.

This change is purely cosmetic and does not affect the operation of your firewall. Path monitoring will continue to work correctly if you have it enabled on other routes. If it's not enabled, nothing will change. This is a deliberate change by Palo Alto Networks to make the configuration cleaner and more efficient.

It is explained in this document:

Commit preview shows path-monitor config for static routes deleted unexpectedly when adding a static... 

Hope this helps,

-Kim.