Information on the "Disable Panorama Policy and Objects" and "Disable Device and Network Template" Buttons
Symptom
The Disable Panorama Policy and Objects and Disable Device and Network Template buttons can be found on a firewall by navigating:
Device > Setup> Management> Panorama Settings
Environment
- Firewall
- Panorama
Cause
If you click on either; "Disable device and Network Template" or "Disable Panorama Policy and Objects" and the check boxes "Import Panorama Policy and Objects before disabling", "Import Device and Network Template before disabling" are not checked; then the respective configuration will be deleted from the firewall immediately.
However, this action does not trigger an autocommit. The configuration will be removed from the candidate config, but will remain active in the running config on the dataplane until a Commit operation is performed.
On the other hand, if you select the check boxes, then configuration under Device and Network pushed from the Panorama will be kept on the firewall. This will have the configuration appear as a local configuration.
Resolution
What if the Configuration is Removed by Mistake?
Revert to running config will not bring the Panorama pushed config back, even rebooting the device will not bring the configuration pushed from Panorama back.
There are two solutions:
Solution (A) - If you have not performed a commit on the Palo Alto Networks firewall after clicking OK.
To get the config back perform the following steps:
- Enable the Panorama policy and Objects, Device and Network Template and click OK, Do not commit at this point.
- Send a commit from Panorama to the Palo Alto Networks firewall.
Solution (B) - If you have performed a commit on the firewall locally. After clicking OK then the config that has been pushed from the Panorama will be removed completely from the firewall.
Follow these steps to bring the config back:
- Add the Panorama IP address on the firewall, enable the Panorama Policy and Objects, Device and template and perform a commit on firewall.
Device > Setup > Management > Panorama Settings
- Make sure there is connectivity to Panorama from the firewall. (Check if the firewall appears as connected on Panorama)
- Once the connection has been reestablished, push a commit from Panorama to the firewall.