Panorama push to managed firewalls failed with validation error: '<application name >' is already in use
27529
Created On 09/14/22 18:18 PM - Last Modified 10/24/22 20:02 PM
Symptom
- The Panorama Push will be failed with below validation error with specific <application name>:
Operation Commit All
Status Completed
Result Failed
Details
Validation Error:
vsys -> vsys1 -> application-status -> '<application name >'-uploading' is already in use
vsys -> vsys1 -> application-status is invalid
Commit failed
- Below error with specific <application name> will presented in configd.log (less mp-log configd.log)
Error: pan_schema_verify_set_constraints(pan_schema_verify.c:374): '<application name >' is already in use near line <line number >
Environment
- Panorama with PAN-OS 10.1
- Managed Firewall with PAN-OS 10.1
Resolution
- Check the application status with below command
> request get-application-status application <application name>
- Result would show the application enable/disable status in shared and vsys level (device group in panorama)
Panorama:
M-200> request get-application-status application powtoon-uploading
Application : powtoon-uploading
Device-Group Status Location
------------------------------------------------------
shared enabled shared
vsys1 disabled shared
Firewall :
PA-7080> request get-application-status application powtoon-uploading
Application : powtoon-uploading
Vsys Status Location
------------------------------------------------------
shared disabled shared
vsys1 disabled vsys1
- Success depends on application status on panorama and managed firewall , there would be 16 possible combinations for push :
| Application status |
Panorama: Shared Enable |
Panorama: Shared Disable |
Panorama: Shared Disable |
Panorama Shared Enable |
|
Firewall: Shared Enable | Successful | Successful | Successful | Successful |
|
Firewall: Shared Disable | Successful | Successful | Successful | Successful |
|
Firewall: Shared Disable | Successful | Successful | Failed | Failed |
|
Firewall: Shared Enable | Failed | Successful | Successful | Successful |
- You can change the application status in target vsys with GUI access under Objects > Applications (Same in panorama device group )
- The enable or disable the applications on the Shared Device group must be done using the CLI command listed below.
> request set-application-status-recursive application *application name* status *enabled/disabled*