Error:
An unexpected error occurred. Please click Reload to try again.
Error:
An unexpected error occurred. Please click Reload to try again.
Firewall CLI command to override Panorama-pushed template eleme... - Knowledge Base - Palo Alto Networks

Firewall CLI command to override Panorama-pushed template elements

81184
Created On 09/25/18 19:47 PM - Last Modified 08/11/23 10:11 AM


Symptom


  • Panorama-pushed configurations cannot be changed directly from the managed firewall CLI.
Example:
  • Panorama-pushed permitted-ip configuration is seen on Firewall
  • Using the command "set deviceconfig system permitted-ip x.x.x.x"  on firewall CLI causes error message
> configure
# set deviceconfig system permitted-ip x.y.z.q/m
Server error : set failed, may need to override template object permitted-ip first

Note: Replace x.y.z.q/m with the IP address configured in your network for the firewall.



Environment


  • Palo Alto Firewall.
  • Panorama pushed configuration
  • PAN-OS 9.1, 10.0

 


Resolution


  1. Set the override flag.
  2. Make the desired changes.
  3. commit the configuration.

In the above example: "override deviceconfig system permitted-ip" is added  before the set command:

> configure
# override deviceconfig system permitted-ip
# set deviceconfig system permitted-ip x.y.z.q/m
# commit
# exit
 

Note: Replace x.y.z.q/m with the IP address configured in your network for the firewall.

 

 

 



Additional Information


  • Override command is only for overriding template pushed elements and not device groups.
  • Override command can be used to override only certain template pushed elements. To check what elements can be overriden, inside of the CLI press "?" or TAB after each keyword:
# override <tab>
  captive-portal              captive-portal
  deviceconfig                deviceconfig
  dns-proxy                   Assign DNS proxy parameters
  global-protect              GlobalProtect
  group-mapping               group-mapping
  network                     network configuration
  shared                      shared
  ts-agent                    ts-agent
  url-admin-override          url-admin-override
  url-content-type            url-content-type
  user-id-agent               user-id-agent
  user-id-agent-sequence      user-id-agent-sequence
  user-id-collector           user-id-collector
  vm-info-source              vm-info-source
  zone                        zone
 


Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cld5CAC&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail

Choose Language