topic Re: Does Config Lock disable the "OK" button on changes? in General Topics

Does Config Lock disable the "OK" button on changes?

jwolach — Tue, 23 Oct 2012 17:54:16 GMT

I thought a Config Lock is supposed to disable the "OK" button when making configuration changes. Could someone please confirm that's the case?

Re: Does Config Lock disable the "OK" button on changes?

gswcowboy — Tue, 23 Oct 2012 18:53:16 GMT

Doesn't disable the OK but it does relay the block upon clicking said OK button.

Blocks other administrators from making changes to the configuration. This type of lock can be set globally or for a virtual system. It can be removed only by the administrator who set it or by a superuser on the system.

Re: Does Config Lock disable the "OK" button on changes?

jwolach — Tue, 23 Oct 2012 19:12:57 GMT

Thanks for the clarification. One additional question, can a Superuser make changes even if there's a Config Lock taken by another user? The reason for that question is because my PAN is allowing the SU to make changes to the config even though there's a Config Lock taken.

Re: Does Config Lock disable the "OK" button on changes?

gswcowboy — Tue, 23 Oct 2012 19:15:07 GMT

On my test, I was attempting to make a config change with another 'superuser' account and was prompted with that message.

Re: Does Config Lock disable the "OK" button on changes?

jwolach — Tue, 23 Oct 2012 19:17:29 GMT

What version PAN-OS are you using?

Re: Does Config Lock disable the "OK" button on changes?

gswcowboy — Tue, 23 Oct 2012 19:20:51 GMT

sw-version: 4.1.8-h1

Re: Does Config Lock disable the "OK" button on changes?

jwolach — Tue, 23 Oct 2012 19:35:15 GMT

Ok... something's very weird. I am also running 4.1.8 and yes, I am getting the lock dialog box when I tried to create a new Address Object, just like you show in your screenshots. However, if it allows me to create a new Administrator account under the Device -> Administrators menu. Hmmm!!!! Can you try it and let me know if you get the same results?

Re: Does Config Lock disable the "OK" button on changes?

gswcowboy — Tue, 23 Oct 2012 20:00:20 GMT

Admin (superuser) locks config. 'Renato' superuser logs in and attempts to create another superuser (testadmin) but failing to create it due to config lock.

renato 10.10.10.1 Web 10/23 10:58:29 00:07:49s

admin 172.16.20.24 CLI 10/20 09:54:38 74:49:47s

[2012/10/23 12:59:52]

<role-based>

</role-based>

</permissions>

<phash>$1$orjkikoe$J.X5P497nbJ5Uty9yNrtc0</phash>

</request>

<response status="error" code="13"><msg><line>Configuration is locked by admin</line></msg></response>

Re: Does Config Lock disable the "OK" button on changes?

jwolach — Tue, 23 Oct 2012 20:50:30 GMT

Here's my scenario...

Admin (superuser) logs in using Firefox browser. Admin takes the Config Lock.

Mickey (superuser) logs in using IE browser. Mickey attempts to create another superuser (testadmin) and SUCCEEDS! Mickey also attempts to create a new Address object and gets an error message due to the config lock. Mickey also attempts to change the Application on a Security Policy and SUCCEEDS!

Don't understand why?

Re: Does Config Lock disable the "OK" button on changes?

mharding — Tue, 23 Oct 2012 20:59:41 GMT

It's probably due to the Device/Network vs Object/Policy config.

The lock must only be honored when making changes to the object/policy side of the config. When you add a new user, you're modifying the device config.

It would be interesting to see the results if you added the object first, and then tried to create a new user.