Packet Buffer Protection setting is not applied on firewall zones after successful Panorama template push
Symptom
- Packet Buffer Protection setting is not applied after successful Panorama template push.
On Firewall:
- CommitAll job from Panorama template push was committed successfully on applicable firewall,
- However, the Panorama pushed PBP (template) setting did not get applied on firewall
- system log (show log system) display the job completed.
YYYY/MM/DD 18:41:53 info general general 0 CommitAll job enqueued. Enqueue time=YYYY/MM/DD 18:41:53. JobId=10. User: panorama. Type: Full
YYYY/MM/DD 18:41:53 info general general 0 CommitAll job started processing. Dequeue time=YYYY/MM/DD 18:41:53. JobId=10.User: panorama
YYYY/MM/DD 18:41:58 info general general 0 Panorama push template PA-820_stack with merge-with-candidate-cfg flags set.
JobId=10.User=panorama. Dequeue time=YYYY/MM/DD 18:41:53. TPL version: 30.
YYYY/MM/DD 18:43:59 info general general 0 Config installed
YYYY/MM/DD 18:44:42 info general general 0 CommitAll job succeeded. Completion time=YYYY/MM/DD 18:44:42. JobId=10. User:panorama
Environment
- Panorama managed Firewalls
- Supported PAN-OS
Cause
Packet Buffer Protection (PBP) settings on Panorama Template is not applied as expected.
Resolution
1. Ensure the firewall zone(s) setting is on "Revert" (Solid Green Cog) mode ... (NOT in override mode)
Note: If firewall zone(s) is in override mode, please revert it to Solid Green Cog (Using Panorama Force Template Values)
PA-820 > Network > Zone > Highlight applicable zone > Click on "Revert" on the bottom section (Repeat the same steps on other applicable zones)
2. On Panorama, disable PBP setting on applicable Panorama Template
Panorama > (Template) Network > PA-820 > Select Applicable zone > Disable PBP on applicable zones
3. Commit to Panorama and Push the updated template to applicable firewall
4. Re-enable PBP setting on applicable Panorama Template
Panorama > (Template) Network > PA-820 > Enable PBP on applicable zones
5. Commit to Panorama and Push the updated template (with PBP enabled) to applicable firewall
6. Verify on firewall if the PBP setting pushed from Panorama are applied successfully on applicable zones
PA-820 > Network > Zone > Verify the PBP setting