Palo Alto Predefined IP Commit Error Fix

July 1, 2023

In this post I will detail how to resolve the Palo Alto commit error when trying to commit a predefined IP list.

Below is an example of the error

Validation Error: external-list -> Palo Alto Networks Tor exit IP Addresses -> type -> predefined-ip -> url 'panw-torexit-ip-list' is not a valid reference external-list -> Palo Alto Networks Tor exit IP Addresses -> type -> predefined-ip -> url is invalid

I’ve commonly ran into the issue on a fresh Palo Alto setup right after loading the day 1 configuration and trying to make that commit.

Here is step-by-step how to fix the predefined IP list error.

Login to the Palo Alto firewall.
Click on Device

Click on Dynamic Updates

…

Upgrade Palo Alto Firewall HA Pair (Active/Passive)

October 4, 2022

Palo Alto has some great documentation about how to do basically everything. Sometimes it’s a bit buried. These are my short and long cheat sheets for upgrading a Palo Alto Networks firewall in an Active/Passive High Availability Pair.

If you want to preform the upgrade using CLI only please see my post Upgrade Palo Alto HA Pair (Active/Passive) with CLI for more details.

Quick Cheat Sheet

Confirm local firewall admin access
Confirm management network access
Confirm upgrade path
Review release notes
Review Upgrade/Downgrade Considerations
Complete upgrade checklist
Download content updates
Turn off HA preemptive election if on
Export running config and tech support files on each firewall
Download the main version and preferred version of PAN-OS
Make the Primary firewall the Passive firewall
Upgrade the Primary firewall
Make the Primary firewall the Active firewall
Upgrade the Secondary firewall
Confirm all works
Turn on HA preemptive election if it was originally on

Long Cheat Sheet

Upgrade path and sanity checks

Check your upgrade path with Palo Alto’s Documentation Here is the upgrade path to PAN-OS 10.2
Check what the preferred releases are for your upgrade path. You can do that here. (You will need a Palo Alto support account to view the link)
You always need to do every PAN-OS update as in you can’t jump from 8.1 to 9.1 you need to do 8.1 then 9.0 then 9.1
Review the Upgrade/Downgrade Considerations. Here are the Upgrade/Downgrade Considerations for PAN-OS 10.2.
Review and complete the PAN-OS Upgrade Checklist. Here is the Upgrade Checklist for PAN-OS 10.2.
Review the release notes for the version you are upgrading to for each version along your upgrade path. Here are the release notes for PAN-OS 10.2.
Confirm you have a working local firewall admin access
Make sure you can access the firewalls via their management IPs

For my example, FW01 is the Primary firewall and currently Active firewall and FW02 is the Secondary firewall and currently Passive firewall and they are both running PAN-OS 10.1 version 10.1.6-h6 which is the current preferred release for that version. We will be upgrading them to PAN-OS 10.2 version 10.2.2-h2 which is the current preferred release for that version.

…