topic Re: Can I verify a config before doing a commit? in General Topics

Can I verify a config before doing a commit?

dabels — Mon, 16 Apr 2012 22:19:59 GMT

I was writing a rule to allow ciscovpn to only certain addresses, so I added a destination and the application I chose was ciscovpn. I added it to the policy and then did a commit. it came back with messages saying that ciscovpn needed ike to function and it was denied in the default deny. so I added ike and did a commit, and got a message saying that it needed ssl, so i added ssl and got another message. what I would like to do is have some way to know all of the possible needs before doing a commit so that I don't spend all day doing one thing... so is there a way to verify the config before doing a commit?

Re: Can I verify a config before doing a commit?

zarina — Mon, 16 Apr 2012 22:50:25 GMT

You can try using the validate candidate config under Device -> Setup -> Operations

Re: Can I verify a config before doing a commit?

rmonvon — Tue, 17 Apr 2012 04:27:40 GMT

Hi...The validate config feature will only display errors but not app dependency which is described here.

One method is to allow all applications on tcp/udp ports that the ciscovpn operate on. Then review the traffic log to see which apps are detected for the ciscovpn and allow only those apps.

Thanks.