This document describes how to delete the default configuration of a Palo Alto Networks firewall using a forced Panorama template. A Palo Alto Networks firewall is preconfigured with a default Virtual Wire (vwire) configuration using the ethernet1/1 and ethernet1/2 interfaces. The following examples show the default vwire configuration:
Steps
On the managed firewall, delete the default-vwire configuration under Network > Virtual Wires.
Under the template configuration in Panorama, configure the ethernet1/1 and ethernet1/2 as Layer3. Assign zones, respectively.
Keep the Virtual Wires section empty in the same template
Commit the configuration on the firewall from the Panorama with the 'Force Template Values' option checked.
The commit should be successful and the interfaces on the firewall should now be changed to Layer3.
Warning: If the default-vwire configuration on the firewall is not deleted (step 1 above) before the Panorama push, the commit fails with the following error: