After Panorama Upgrade Encountering Commit Error: is not an allowed keyword
Symptom
After upgrading Panorama, the following commit error is encountered: "is not an allowed keyword".
Cause
When upgrading a device, be it Panorama or a firewall, the first thing it does is try and re-parse the previosuly saved configuration for it's self or other devices and re-index the configuration to match the new OS code being run.
The upgrade process on Panorama can cause an index issue with the configuration saved in it's memory from the device. The configuration in memory is out of index/out of sync with the managed device.
Resolution
Removing the device from Panorama post upgrade and re-add it back will re-populate and and re-index the firewall's configuration information correctly into the OS on Panorama reflected in the upgrade change. Please follow the following steps
- Delete the firewall from any device group it is a part of.
GUI: Panorama > Device Groups > < Select firewall name > Delete
- Once done, Remove the firewall from any template and template stacks.
- You can now delete the firewall from Panorama configuration
GUI : Panorama > Managed devices > Summary > (Select the firewall) > Delete
- Commit the changes.
- Re-add the firewall back to Panorama. If needed, use the link to the following kb article for guidance:
Additional Information
Please follow the Panorama Admin Guide for additional information on migrating the NGFW into Panorama Management:
Panorama Administrator's Guide