Panorama Commit Failed: show jobs processed When the Push Never Reaches the Firewall

Palo Alto · Techclick CLI troubleshooting lab

Panorama says commit successful. The firewall still runs yesterday's rule. Operations wants a root cause, not another push.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

• Name the first CLI command to run on Palo Alto for this ticket

• Separate the layer that is actually broken from the layer people blame

• Apply one scoped fix instead of a global disable

• Prove the ticket closed with a session, log, or counter

Quick answer

A Panorama commit is not a firewall commit. Use show jobs processed on Panorama and on the firewall, then push again only to the devices that failed.

Why this ticket shows up

Panorama can save a config that never reaches a disconnected, out-of-sync, or locked firewall. The GUI success is the Panorama job, not the device job.

Symptoms operators actually see

• Firewall running-config older than Panorama

• Device is disconnected or in-progress forever

• Commit lock from another admin

• Partial push to a device group

CLI first — copy this block

Run these on the Palo Alto device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

show jobs processed
show jobs pending
show devicegroups name DG-BRANCH
show devices all
request log-fwd-ctrl device <serial> action latest
show config audit last-committed

How to read that output

Look at the Type column. A Panorama Commit can succeed while a CommitAll / push is still pending or failed on one serial. devices all must show connected and in-sync.

Triage order

1. show jobs processed on Panorama and find the CommitAll.

2. Note the serials that failed.

3. On those firewalls, show jobs processed and check commit locks.

4. Fix connectivity or the lock, then push only that device group.

5. Verify the rule UUID on the firewall matches Panorama.

Classic traps

What you see	Real cause	Fix
Push everything again	One firewall is locked	Clear the lock first
Firewall is connected	It is still out of sync	Read the in-sync column
Local override exists	Local rule shadows Panorama	Check local overrides

Proof the ticket is closed

• Firewall show jobs shows a successful commit with the new timestamp

• New rule is visible on the device

• Panorama device state is in-sync

Say this in an interview

I treat Panorama commit and device commit as two jobs. Success on Panorama is not success on the box.

---

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/