SD-WAN configuration push from Panorama fails with "Tunnel Interface x has no virtual-router configured" error
16556
Created On 03/24/21 13:15 PM - Last Modified 03/15/25 00:08 AM
Symptom
When attempting to commit an SD-WAN configuration from Panorama to a local device, the commit fails with errors like the below:
Autogenerated SDWAN configuration
IPSec Tunnel tl_0102_016201028634_0102 Tunnel Interface tunnel.903 has no virtual-router configured
Configuration is invalid"Environment
- Panorama managed Palo Alto Firewalls.
- PAN-OS 9.1 and above.
- SD-WAN Plugin installed.
Cause
- This error is seen when the configuration pushed from Panorama has the settings related to the virtual router overridden on the local firewall.
- Example: If the interface configuration is overridden on the local device from what is pushed from the Panorama template.
Resolution
- Remove the Local override configuration from the managed Firewall or merge it into a Panorama Template.
- If this is not possible, i.e Firewall requires a different configuration than other devices in the template, then a new template will need to be created for this particular device(s).
Note: One can also use the "force template values" setting from Panorama during the "commit" operation to resolve the issue, but be aware that this will revert all locally overridden template values and may not be desired! Only use this method if you are sure that you want the Panorama template settings to override any locally configured values on all of the firewalls in the template.
Additional Information
Force Template Values