topic Re: Export/Import Named Configuration Snapshot in General Topics

Export/Import Named Configuration Snapshot

RVizcarra — Tue, 18 Apr 2023 18:15:26 GMT

Hi everyone!

Can someone confirm that the subject can only be done by "superuser" account?

I can't find any documentation that says so. I'm wondering because "export device state" is visible for superuser account, when using a "device administrator" (dynamic role), "export device state" is not visible. Both Export and Import named configuration snapshot is available but when I try, it gives me the error "You don't have permission to view this page" / "You do not have permission to do this operation".

Re: Export/Import Named Configuration Snapshot

RVizcarra — Wed, 19 Apr 2023 05:23:46 GMT

@BPry @TomYoung Hi! Appreciate it if you could share your input on this.

Re: Export/Import Named Configuration Snapshot

TomYoung — Wed, 19 Apr 2023 08:39:06 GMT

Hi @RVizcarra ,

I get the same error trying to export a named configuration snapshot on PAN-OS 10.1.8-h2. Although that limitation is not listed here -> https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/firewall-administration/manage-firewall-administrators/administrative-role-types, it makes sense because a device admin could import a configuration which changes his/her dynamic role.

I did find this article -> https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CljiCAC&lang=en_US&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail.

I don't have a lab NGFW at the moment to test the load operations, but the export operations are denied. It makes sense that load operations don't work either.

Thanks,

Tom

Re: Export/Import Named Configuration Snapshot

RVizcarra — Wed, 19 Apr 2023 09:12:59 GMT

Hi @TomYoung ,

Thank you for your response. It appears that device admin cannot do it because of the fact that they could possibly grant superuser access or change their roles.
It's just uncommon that there is no documentation. Btw, thanks again!

Re: Export/Import Named Configuration Snapshot

dfarah.farah — Tue, 24 Sep 2024 13:03:30 GMT

Hi all,

I got same issue, trying to Export/Import Named Configuration Snapshot and i got " you do not have permission to view this page". I'm login PA with admin without super admin, can someone confirm if Export/Import Named Configuration Snapshot ony work with super admin account only?

Thanks.

Re: Export/Import Named Configuration Snapshot

SudarshanKasat03 — Wed, 05 Mar 2025 04:56:22 GMT

Hi,

We were able to export the named configuration from the TACACS account before doing the upgrade from 10.2.8 version. But as we moved to 11.1.4-h7 version we started to face the issue.

Can anyone suggest if this is some kind of bug or issue at the firewall end?

Thanks in advance

Re: Export/Import Named Configuration Snapshot

it-purchasing — Tue, 25 Mar 2025 17:57:55 GMT

Hi SudarshanKasat03,

We have a similar issue, prior to updating to 11.1.6-h1 we were able to export saved named configuration snapshots. I am not aware of permissions being changed or known issue with versions matching the issue. Solutions and suggestions appreciated.

Re: Export/Import Named Configuration Snapshot

SudarshanKasat03 — Wed, 26 Mar 2025 02:56:15 GMT

Hi,

As per TAC they have enhanced the security. Hence after the upgrade it is not possible to export the save named config. TAC suggested to use Superuser access.