Who rated this post

Hi @alirezabtf ,

Panorama pushes the config twice to the NGFWs.  Once for device groups, and once for templates.  This is 2 separate commits on the NGFW.  I have always seen the device group pushed 1st.   That fails since the zone does not yet exist in the template.  If you don't want the change to be disruptive, follow @kiwi's process.  If you don't mind a short outage (maintenance window) AND the zone change will not impact Panorama connectivity, try this process:

1. Create a new zone with the new name.  Commit and push.
2. Delete the new zone and rename the existing zone to the same name.  The rename will modify all the policies.  Commit and push.

When the device group commit is done, the new zone already name exists, but with no interfaces.  When the template commit is done, connectivity is restored.

Thanks,

Tom

PS I have seen the device group commit fail, but then work when the template changes are committed.  It appears the DG changes remain in the candidate config.  I have always seen zone changes fail completely unless I follow a process similar to the ones above.