Panorama commit and push to firewall fails with Error: Missing service value.
29972
Created On 11/19/18 22:13 PM - Last Modified 11/15/19 22:31 PM
Symptom
When importing config from firewall and pushing it back to the firewall, it fails with the error, Error: Missing service value.
Error: Missing service value
Error: Failed to parse security policy
(Module: device)
Commit failed.Environment
- Panorama VM with PAN-OS 8.1.4.
- PA-3220 with PAN-OS 8.1.4-h2.
Cause
When an existing firewall is added as a managed firewall under Panorama, the configuration from the firewall is imported to Panorama and pushed back to the firewall. During this operation, service under one or more security policies is marked as None. This causes an error during the commit operation.
Resolution
- From the CLI of the firewall, use the command less mp-log devsrvr.log to monitor the device server log.
- Perform the commit and push on Panorama. Go over the logs where the commit is failing. it should display the rule name that is missing the service. In the example below the rule Test Security Policy is causing commit failure due to missing service value:
2018-11-19 20:53:27.955 +0000 vsys1 Security Policy: 133 platform accumulated rules; 133 total rules; 133 active rules; 0 disabled rules;
2018-11-19 20:53:27.960 +0000 Error: pan_policy_parse_core_columns(pan_config_parser.c:10497): pan_policy_parse_service('Test Security Policy') failed
2018-11-19 20:53:27.960 +0000 Error: pan_app_policy_from_obj(pan_config_parser.c:11386): pan_policy_parse_core_columns('Test Security Policy') failed
2018-11-19 20:53:27.960 +0000 Error: pan_rulebase_from_obj(pan_config_parser.c:15940): Failed to parse security policy
2018-11-19 20:53:27.960 +0000 Error: pan_vsys_from_obj(pan_config_parser.c:22437): pan_rulebases_from_obj failed
2018-11-19 20:53:27.960 +0000 Error: pan_config_from_obj(pan_config_parser.c:23550): pan_vsyses_from_obj failed
2018-11-19 20:53:27.997 +0000 Error: pan_ctrl_save_config(pan_config_handler_sysd.c:2012): Error compiling config
<<vsys1>>
Error: Missing service value
Error: Failed to parse security policy
<</vsys1>>
- Once the rule name is identified, Goto Panorama GUI: Policies > Security > search for Test Security Policy.
- Open this rule to modify the Service section under the Service/URL category tab from None to "application default" or "any" as per requirements.
- Commit and change to Panorama and push the same to the firewall. This should resolve the error.