Panorama template zone logging profile and dependency loop

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.

Panorama template zone logging profile and dependency loop

L1 Bithead

I have entered a dependency loop situation in Panorama that surprised me a little.

We have installed a new firewall, and configured it to talk with Panorama. It shows up here and we are ready to push configs.

Said firewall have a template stack associated, and it's placed in a device group to receive a base set of policies.


Now the template-stack contains all network definitions, like for instance interface names and zones. Part of the zone configuration we have configured a zone logging profile that sends Zone logs to panorama.  We did this since we saw for instance scan sweep warnings in the firewall logs, but not in Panorama logs (forwarded) and figured out this was part of the zone logging, but not rule or threat logs.


Funny thing though is that Log forwarding settings is configured under objects in the device groups section, while it's then possible to use it in a template, like I have done as a log forwarding profile on a security zone.


Now trying to perform a push to the new firewall, it ends up being 2 different commits on the firewall. One commit for all the device group config (policies and objects), and one commit for the template configurations.


So the Policy push (commit) fails since the security zones are not present. A second push attempt would have fixed this if the template commit had been successful, but this fails also since the log forwarding profile used on the security zone isn't in place due to the policy commit failing, and behold we have a dependency loop.


There are workaround to this of course, but I find that a bit tedious, and I was a bit caught out by this dependency loop between template and objects in device groups.


Any tips or tricks to be shared about this conundrum ?

I would really like to be able to just assign a firewall to the device group and template it should belong to right from the start, instead of applying a 2 step procedure with an in between template or device group.

  • 0 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!