Committing Template Configurations When Referencing Device Group Objects
Symptom
When attempting to create a template that references configurations from a Device Group—such as Address Objects, Address Groups, or Services—the template push from Panorama to the managed device fails.
Environment
-
Panorama: All supported PAN-OS versions managing firewalls via Device Groups and Templates
-
Palo Alto Networks Firewalls: All managed hardware and VM-Series firewalls
Cause
This occurs because the referenced items have not yet been committed and pushed to the firewall. Because the managed firewall lacks these definitions, it rejects the incoming template configurations that depend on them.
For example:
If an object is created in the Device Group (Panorama > Objects > Addresses)
And referenced in the template configuration (Panorama > Network > Interfaces)
The template push commit fails since the Device Group configurations are not yet pushed to the device
"Validate Changes" also shows that the template push fails with the same error messages
Resolution
Perform a commit from Panorama for the Device Group, ensuring the Include Network and Device Template option is enabled. This allows Panorama to push the required template configuration changes alongside the referenced Device Group objects in a single, successful operation.
To ensure that the commit of template configurations works when referencing Device Group objects, the commit must be performed from the Device Group tab with the Include Device and Network Templates option enabled.
Commit succeeds now that both Device Group and Template configurations are committed together
Checking on the firewall shows the object is committed and referenced correctly: (Firewall WebGUI > Network > Interfaces)