push from panorama to PA firewalal failed because of " is already in use because of policy and NAT already in use)

[Elwess]

Hi,

We have panorama in 9.1.9 version and  PA-220 in same version.

we imported configuration from pa to panorama, added just e pôlicy rule and pushed again the template and device group to same firewall. 

but then we get always pushh failed with errors saying NAT rules and policy rules are already in use !

is that normal ? we have exactly the same rules on device group and on the firewall. , we tried to force value but still we get same eror :

Last Push State Details
Details:
. Validation Error:
. service -> port-2083 'port-2083' is already in use
. service -> port-2083 'port-2083' is already in use
. service is invalid
. rulebase -> security -> rules -> allow all 'allow all' is already in use
. rulebase -> security -> rules -> allow all 'allow all' is already in use
. rulebase -> security -> rules is invalid
. rulebase -> security is invalid
. rulebase -> nat -> rules -> MGMT-to-WAN 'MGMT-to-WAN' is already in use
. rulebase -> nat -> rules -> LAN-to-WAN 'LAN-to-WAN' is already in use
. rulebase -> nat -> rules -> MGMT-to-WAN 'MGMT-to-WAN' is already in use
. rulebase -> nat -> rules -> LAN-to-WAN 'LAN-to-WAN' is already in use
. rulebase -> nat -> rules is invalid
. rulebase -> nat is invalid
. rulebase is invalid

any help please

[jdelio]

The already in use can be an issue when you are trying to use Panorama to Manage a firewall and want to re-use the same names for objects.. 

Please see this article for more information about this. 

ADDRESS/ADDRESS GROUP OBJECTS MUST HAVE DIFFERENT NAMES 

[Eric_4617]

In case anyone else runs in to this issue, check your template stack and ensure the device is still added.  I just ran into a similar issue as OP and in the end, the device was somehow removed from the template stack and had to be re-added. This may have occured when I "disable panorama policy and objects" or the "disable device and network templates".  Haven't seen this happen before.

This also applies to the error " $var_SomethingHere' is not a valid reference".  Variables don't exist on the local firewall if the device isn't added to the template stack.