topic Re: Panorama Commits--what actually happens when I commit to a device-group? in General Topics

Panorama Commits--what actually happens when I commit to a device-group?

mgentile — Mon, 23 Sep 2013 01:04:01 GMT

What happens when I push a policy from Panorama to a device-group firewall? Does Panorama always push the entire configuration file, or does it first perform a 'diff,' and only push the changes? If it performs a diff, what is the underlying mechanism it uses to track the changes? Is it some sort of table of rule hashes, etc? It seems pretty silly to push an entire config if only a single line changes.

Re: Panorama Commits--what actually happens when I commit to a device-group?

HULK — Mon, 23 Sep 2013 02:11:57 GMT

Hi Mgentile,

As per my understanding, upon commit the PAN-OS will always verify the difference between running config and the candidate config and then push only the difference or changes to the firewall.

Hope this helps.

Thanks

Re: Panorama Commits--what actually happens when I commit to a device-group?

pulukas — Mon, 23 Sep 2013 12:04:29 GMT

See the full description of the commit process and all the options in the Panorama Admin guide page 79

Panorama Administrator's Guide 5.1

Commit Changes on Panorama

When you edit the configuration on Panorama, you are making changes to the candidate configuration file. The

candidate configuration is a copy of the running configuration along with the modifications that you have saved

using the Save option. The Panorama web interface displays all the configuration changes immediately, however

the changes are not implemented until you commit the changes. The commit process validates the changes in

the candidate configuration file and saves it as the running configuration on Panorama.

Re: Panorama Commits--what actually happens when I commit to a device-group?

mschuricht — Mon, 23 Sep 2013 16:44:48 GMT

The entire config is pushed during the commit and not just the changes.

Re: Panorama Commits--what actually happens when I commit to a device-group?

jwolach — Mon, 06 Jul 2015 17:27:00 GMT

Is a FULL commit performed on the actual firewall(s) or a PARTIAL commit?

Re: Panorama Commits--what actually happens when I commit to a device-group?

jdelio — Mon, 13 Jul 2015 16:40:28 GMT

Jwolach,

When a commit from Panorama to a device group, It is a Full commit. But you do have some options at the bottom of the screen that you can choose:

Include Device and Network Templates—

This option is available when committing a Device Group from Panorama and is a combo operation that will include both the device and network template changes. The template that will be applied to the device is the template that the device belongs to as defined in Panorama > Templates. You can also select Commit Type Template to commit templates to devices.

Re: Panorama Commits--what actually happens when I commit to a device-group?

jwolach — Mon, 13 Jul 2015 16:50:38 GMT

Hello Jdelio,

I'm familiar with the Include Device and NetworkTemplates checkbox when performing a Device Group commit. What I wanted to know, is what type of commit actually takes place on the managed firewall(s) when just a Device Group or Device and Network Templates commit is performed. Is it a Granular Commit or a Full Commit?

Thanks,

Jeff

Re: Panorama Commits--what actually happens when I commit to a device-group?

jdelio — Mon, 13 Jul 2015 18:31:24 GMT

It is a Full commit.