Panorama read only tunnel interfaces?

[Dan_Fleming]

Hi

I have a Panorama appliance and i am configuring our firewalls for global protect VPN, but i noticed once i pushed out the config for the gateway, it fails as the because it says the tunnel interface doesnt have a virtual router! 

I checked my config on the panorama and i have pushed out a default router, zones and interfaces to both firewalls. I have then override changes locally on each firewall for the default router, but when i dive further into this on each firewall it seems that the tunnel interfaces on the firewalls that read only and have the virtual router missing. On the Panorama it seems fine but on the firewalls it just wont go through.

Has anyone else noticed tunnel interfaces configured on a Panorama being read only on a firewall?

[RamprakashRT]

Spoiler

Hi @Dan_Fleming 

When you override interfaces in the firewall , virtual router also will be overrided. Check the icon colour near by  Virtual router name  , if it is fully green it will accept changes from panorama . If it is partially green and yellow it will not accept changes from the panorama push.

Thanks,

Ram

[Dan_Fleming]

Thanks but i know how the override works and it has flowed through most of the settings on the firewalls but when i look at the tunnel settings on the firewall there is no override option see screen shot below.

But if i go to the ethernet interfaces for example you can see the override and revert icons at the bottom, as well as assigned to the interfaces that i have changed. This is the same as the virtual router as well just for what ever reason the tunnel interfaces arent getting the override or revert options come up directly on the firewall

[JoaoPedreiro1]

Hi Dan,

Can you share if you got this issue fixed?

Thank you.

[NWijerathne]

Hi Dan,

We are also facing same issue , can you suggest for the same

Awaiting for your reply

[NWijerathne]

Hi @RamprakashRT

We are also facing same issue , can you suggest for the same

Awaiting for your reply

[MarSanchez]

Same issue, I am also trying with the cli command override, but not luck

Server error : Cannot override /config/devices/entry[@name='localhost.localdomain']/network/interface/tunnel, not valid override object