Commit from Panorama to Firewall fails on multi-vsys firewalls after upgrade to 10.2
2199
Created On 09/22/23 17:04 PM - Last Modified 06/04/25 21:08 PM
Symptom
- Commit from Panorama to a Firewall fails after Upgrade to 10.2. version.
- Multi-Vsys is configured on the Firewalls.
- The error message is shown below.
Validation Error:
vsys -> vsys2 -> application -> xxxxxx 'xxxxxx' is already in use
vsys -> vsys2 -> application is invalidEnvironment
- Panorama Managed Firewalls
- PANOS-10.2.x,
- Multi-vsys firewalls
Cause
- This is due to the Change in the default behavior for Shared objects on multi-vsys firewalls managed by Panorama.
- Per documentation "Configuration objects in the Shared device group are now pushed to a Panorama Shared configuration context for all virtual systems rather than duplicating the shared configuration to each virtual system to reduce the operational burden of scaling configurations for multi-vsys firewalls."
Resolution
- Before pushing the current Panorama managed configuration, check for any locally configured Shared Objects in the firewall that may have an identical name to an object in the Panorama shared configuration.
- Rename or Delete them before the Panorama push.
- Otherwise, the commit push from Panorama will fail due to a Validation Error
- Refer to Changes of behavior in PAN-OS 10.2 for Panorama management of multi-vsys firewall