Panorama template zone logging profile and dependency loop

[jonhdoe79]

I have entered a dependency loop situation in Panorama that surprised me a little.

We have installed a new firewall, and configured it to talk with Panorama. It shows up here and we are ready to push configs.

Said firewall have a template stack associated, and it's placed in a device group to receive a base set of policies.

Now the template-stack contains all network definitions, like for instance interface names and zones. Part of the zone configuration we have configured a zone logging profile that sends Zone logs to panorama.  We did this since we saw for instance scan sweep warnings in the firewall logs, but not in Panorama logs (forwarded) and figured out this was part of the zone logging, but not rule or threat logs.

Funny thing though is that Log forwarding settings is configured under objects in the device groups section, while it's then possible to use it in a template, like I have done as a log forwarding profile on a security zone.

Now trying to perform a push to the new firewall, it ends up being 2 different commits on the firewall. One commit for all the device group config (policies and objects), and one commit for the template configurations.

So the Policy push (commit) fails since the security zones are not present. A second push attempt would have fixed this if the template commit had been successful, but this fails also since the log forwarding profile used on the security zone isn't in place due to the policy commit failing, and behold we have a dependency loop.

There are workaround to this of course, but I find that a bit tedious, and I was a bit caught out by this dependency loop between template and objects in device groups.

Any tips or tricks to be shared about this conundrum ?

I would really like to be able to just assign a firewall to the device group and template it should belong to right from the start, instead of applying a 2 step procedure with an in between template or device group.