"Bad template push candidate on disk"

[anthonywadmin]

Good Afternoon Everyone, 

I will start off with, I am very new to Palo Alto and I just want to make sure I don't jack anything up in my production environment. I got the following message when trying to push a change to one of my firewalls today: "Bad template push candidate on disk". I have done some research and it appears the following is the corrective action: 

Resolution
Follow the below steps to resolve the issue:

1. Removed the firewall from the Template-Stack
2. Commit on the Panorama.
3. Re-added the Firewall to the same Template-Stack.
4. Commit on the Panorama.
5. Then pushed the Template to the firewalls.

My question is, what impact will this have on the firewall itself. When I take the firewall out of the template stack will it still continue to function with the current configuration that it has? When I add the firewall back to the template stack and do a commit, does this have the potential to cause an outage? I just want to make sure if this is going to take down the environment in any way I make the necessary request for an outage.  

[PavelK · Accepted solution]

Hello @anthonywadmin

it looks like you are referring to this KB. These steps will not case any outage. Steps 1 to 4 are performed within Panorama with commit to Panorama only. Until you get to step no.5 the configuration is not going to be pushed to managed Firewall. It is safe to perform these steps without outage.

Kind Regards

Pavel

[anthonywadmin · Accepted solution]

Pavel thank you for the support. I really appreciate it. 

[Agustin_Taub]

Hi 

I am working on a case for one of our clients who is experiencing this same problem.

Reviewing the KB https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PPj9CAG we see that this is exposed for PAN-OS versions 8.1 and 9.0.

Do you know if this is also valid for higher versions?

Thank you very much in advance

[anthonywadmin]

Agustin my firewalls running into this issue were running "PAN-OS 10.6.1-h3". I followed the procedures in the KB and it resolved my issue.