After upgrading Panorama validation check fails when commit is performed with errors like "Duplicate destination" and/or "Duplicate source"
Symptom
Commit validation fails with an error like below:
devices -> localhost.localdomain -> device-group -> DG1 -> pre-rulebase -> security -> rules -> dgs-temp-rule -> destination is invalid. Duplicate destination not allowed
devices -> localhost.localdomain -> device-group -> DG1 -> pre-rulebase -> security -> rules -> dgs-temp-rule -> destination is invalid
devices -> localhost.localdomain -> device-group -> DG1 -> pre-rulebase -> security -> rules is invalid
devices -> localhost.localdomain -> device-group -> DG1 -> pre-rulebase -> security is invalid
devices -> localhost.localdomain -> device-group -> DG1 -> pre-rulebase is invalid
Environment
- Panorama
- All platforms
- Duplicate source and/or destination object entries present in the security policies
Cause
- Starting with PANOS versions: 11.2.3, 10.2.11, 11.1.5, 11.0.7, and 10.2.7-h10:
- Duplicate entries are checked and preventing positive validation occur.
- This is documented underĀ PAN-250909.
Resolution
- Since the duplicate entries were not examined before the upgrade, the Panorama users were often not aware of their existence.
- After upgrading to the PANOS version that checks for those commit became no longer possible.
- Remove the duplicate entries and commit again.
Additional Information
To verify if the issue is being encountered please check the configuration snapshot from before the upgrade and look for the policies mentioned in the validation error.