topic Re: Pn commit and push affect the local candidate configuration of the wall in Next-Generation Firewall Discussions

Pn commit and push affect the local candidate configuration of the wall

Felixcao — Sun, 17 Sep 2023 04:25:12 GMT

The customer has a vm-300 that is configured through panorama management and configure.

An accident occurred where the administrator configured a nat police configuration on the vm-300 August 22,

, but there was no commit and no task modifications were made.

The September 5th, the administator configured an ldap profile for this vm-300 through panorama and committed and pushed it,

A strange thing has happened, the newly added nat police configuration on the vm-300 has changed from a candidate configuration to a running configurationAccording to my understanding, the configuration of pn push does not necessarily change the candidate configuration of the wall to the running configuration

Refer to screenshot:

Customer panorama: 10.2.3 vm-300: 10.2.3

I tested it myself using version 11.0.2 of pn, and the same situation occurred,

Does anyone know that this is a normal design? Is it still possible to have a version bug

Re: Pn commit and push affect the local candidate configuration of the wall

PavelK — Sun, 17 Sep 2023 12:26:25 GMT

Hello @Felixcao

thanks for post!

The scenario you described is expected behavior. When the configuration is pushed from Panorama to managed Firewall the commit all is performed which also commits local uncommitted configuration.

Kind Regards

Pavel

Re: Pn commit and push affect the local candidate configuration of the wall

JeremyGlaus — Mon, 18 Sep 2023 11:32:28 GMT

There is a setting in panorama to prevent this behaviour:

Navigate to Commit -> Push to devices -> Edit Selections and uncheck "Merge with Device candidate config".

There is also the setting "Force template values" if you want to override the local changes.

Best wishes

Jeremy

Re: Pn commit and push affect the local candidate configuration of the wall

PavelK — Mon, 18 Sep 2023 12:42:55 GMT

Hello @JeremyGlaus

thank you for stepping in! The option you pointed out is indeed answer to the question and has an official KB: How Configuration Change is Being Applied Depending on “Merge with Candidate Config” Commit Option. I am going to marked your answer as an accepted solution.

Thank you and Regards

Pavel

Re: Pn commit and push affect the local candidate configuration of the wall

JeremyGlaus — Mon, 18 Sep 2023 15:08:41 GMT

Hey @PavelK

Nice, thank you very much!

Have a good day and best wishes 🙂

Jeremy