topic Re: Any chance of an Automated Rollback on Palo Alto firewalls? in General Topics

Any chance of an Automated Rollback on Palo Alto firewalls?

TomMeadows — Sat, 10 Feb 2018 00:37:11 GMT

Hi-

Im familiar with Juniper equipment which all have the option to 'commit confirm' which automatically reverts the config change if a 2nd commit is not made within a certain period (default 10 mins I think).

Its a life-saver if you have to administer remote devices, bbvsince if your change broke connectivity for any reason, in 10 minutes time, your changes get revoked.

I now have to administer a couple of remote Palo Alto systems.

I don't know of any way to automate a rollback in absence of confirmation.

Does anyone know any way to do this?

Does anyone know if this is on the PANOS roadmap?

Thanks

Tom

Re: Any chance of an Automated Rollback on Palo Alto firewalls?

reaper — Mon, 12 Feb 2018 07:50:29 GMT

Hi Tom

I can't comment on roadmap, but I do knoiw there is a feature request for this:

FR ID: 204

If you reach out to your sales team, they can add your vote to this feature to have it added

Re: Any chance of an Automated Rollback on Palo Alto firewalls?

pulukas — Mon, 12 Feb 2018 23:31:21 GMT

Note how low that FR number is. We have been asking for "commit confirmed" for a long time.

But please contact your Sales Engineer and add your company vote to FR 204. Keep hope alive.

Re: Any chance of an Automated Rollback on Palo Alto firewalls?

JimmyHolland — Fri, 02 Jul 2021 14:12:43 GMT

Just to say for future readers, that a feature for this was released in 9.1 that checks connectivity back to Panorama post-commit: https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-new-features/panorama-features/automatic-panorama-connection-recovery.html

Re: Any chance of an Automated Rollback on Palo Alto firewalls?

KennethMcRae — Tue, 08 Mar 2022 23:43:30 GMT

That's a nice added feature, but not quite auto rollback (unless commit confirmed). In a situation where PANs are managed without Panorama, if you lose access with no OOB, you are hosed until you can get remote hands or travel onsite.

Re: Any chance of an Automated Rollback on Palo Alto firewalls?

BPry — Wed, 09 Mar 2022 04:00:51 GMT

@KennethMcRae,

Just throwing this out there as an option, but if you have a small node on-site you could use to run a script you can automate a configuration roll-back through the API fairly easily. Ideally this actually gets implemented directly in PAN-OS, but it's a viable option for those that don't use Panorama who want this functionality.