Pushing template from Panorama resulting in error

[tjeedigunta]

Imported Palo Alto configuration to Panorama

Modified BGP configuration..to be precise added "deny" rules under bgp>import>

committed changes to Panorama

Pushed the modified templates to the same device from where I imported the config.

Commit is failing with below errors:

• Details:
• . Validation Error:
• . import -> network -> interface 'sdwan' is not a valid reference
• . import -> network -> interface is invalid
• . import -> network is invalid
• . import is invalid
• . vsys is invalid
• . devices is invalid
• . Configuration is invalid

request to kindly help me resolve the error.

[reaper]

how big is the difference of PAN-OS between panorama and the device?

it appears panorama is tryting to push an sdwan interface and the firewall isn't having it

[tjeedigunta]

Panorama is on 9.1.1 and Palo Alto VM is 9.0.6

Is it because of Panorama SDWAN introduced in 9.1.1 that Im not able to push the config?

[reaper]

Panorama should normalize configuration to lower version devices

Is the firewall showing up with the right panos in managed devices? Could be an issue with panorama 9.1.1, could give .3 a shot (or get in touch with support)

[RyanMa]

I was getting the same error after adding a new device in Panorama. Panorama is running 9.1.2 and local device is 9.0.8.   Issue started after Exporting the config bundle from Panorama to the local device.  It looks like it is trying to push the "sdwan" interface which isn't available in 9.0.   I was able to get around it by deleting the "sdwan" interface.  I could not find a way in the GUI but was able to delete from the CLI using the following commands.  After deleting on both and committing in Panorama I was able to push to the device from Panorama with no errors.

On Panorama:
configure
edit template "template name"
edit config vsys vsys1 import network
delete interface sdwan

On Local Device:
configure
edit import network
delete interface sdwan

[telco_muguerza]

Thanks. It works fine. Same issue with my FW on 8.1.15 to Panorama in 9.1

[orapp]

Thanks Ryan,

On Panorama we did it and it solved the issue:
configure
edit template "template name"
edit config vsys vsys1 import network
delete interface sdwan

[Him007]

I had same problem, no need to downgrade the panorama or firewall code... On panorama go to Virtual Systems under the device tab, select vsys1 (whatever you have) remove sdwan from there & you are good to commit it.