About dkane66

All those that are still hitting this.   1. Make sure you are not more than 100 versions off from your Pano Running and the FW configuration. If you are over 100 you will need to do a full push to be able to do selective pushes. 2. If you are still hitting the issue on a version 10.2 you may need to call TAC and have them clear the XML as I stated in an earlier post.   I am on 11.0 code at this point and have had no issues with selective pushes unless we are over 100 revs difference. Hope this helps anyone still having the issues. ... View more

Do you have a custom login page? If so try changing this to default. ... View more

Did you ever resolve this? If so what was your fix? ... View more

TAC Engineer figured it out. My case got pretty high up the ladder because I was putting a lot of pressure on my SAM team to figure it out. The only issues we experienced was Panorama ended up crashing when we tried to do the first mass push. I would suggest a reboot of Panorama after the file delete by TAC is completed. We are still running without any issues. I am pretty confident that this is the solution to the issue. ... View more

I would suggest anyone on 10.2.4 that is hitting this issue open a TAC case. I just had a call with a Root Engineer and they did the following.   1. Removed the corrupt file /opt/pancfg/mgmt/audit/cfg-audit.xml,v 2. From cli, ran debug md5sum_cache clear (this is to force gen all DG/TPL configs so their versions will get updated) 3. Did commit force which recreated the cfg-audit.xml,v 4. Did full push to firewalls and verified versions are getting updated on Panorama with a couple of commits. 5. Did a selective push to one of the firewall and verified the selective push is working.   So far we have not hit an issue with doing selective pushes. It has only been a day so far but my fingers are crossed. ... View more

For those that are sticking with 10.2.4 The workaround from Tac didn't work. This though does work but it is still not a proper selective push. Without Fail we have been able to do pushes to specific firewalls but you still have to select the all Admins section. This is the only way we can consistently make pushes with out a failure and being asked to do a Full Push. Not a great work around but it has been working for us so far, since you can still do a selective commit. ... View more

It should just be the version of Panorama and for me it seems to be with 10.2.4 code. Was on 10.2.3 no issues, moved to 10.2.4 issue started, was told by TAC the issue was resolved in 10.2.4-h3 they even have it posted as a resolved issue in the Release notes. Issue still persists. It seems like 10.2.4 should just be avoided if you are able to, especially if you have a large Palo footprint and a lot of people making changes in Panorama. ... View more

I lucked out on this one as all of my devices that are using DNS Proxy only have a single VSYS. That has allowed me to create a Template that has DNS proxy within it. I did have to create an individual template for each region, this means I only have 5 or so templates to update instead of hundreds. Best thing you can do is try to limit the pain by either creating a specific template just for DNS proxy for all of your devices and just overriding the parts that need it in the xstack. ... View more

Still no update from my Case or SAM team on this one. A full push should resolve the issues but only temporarily. For us right now we have to do a full push about every 3 or so commit/pushes. It sucks, I believe I see the issue and have relayed it to TAC. The safety feature of forcing a full push when something is over 100 revs off is taking into account items that are in a disconnected state. When I look at my required full push, everything that is labelled as out of sync and in need of a push are items that are either Disconnected or not fully managed by Panorama. ... View more

Issue still exists in 10.2.4-h3. Was told to move to 10.2.4-h3 to avoid the issue, no luck. ... View more

I am running 10.1.4 and you still need to disable the MultiVsys option for this within Panorama. ... View more