topic Palo Alto Configuration Using CLI in General Topics

Palo Alto Configuration Using CLI

jasfree — Sat, 04 Jun 2016 12:21:47 GMT

Hello,

My question is as follows:

If I make changes (ruleset, objects, etc.) from the command line, how do I get those changes to show up in the GUI? What if by chance someone else is working in the GUI; what happens to my changes if a save and commit is done? Or, if I perform a save and commit?

Situation:

Brand new firewall is installed and in operation.

There are ~30 Rulesets that have to be entered of various sizes (1-4 Rules, 30 Objects/Applications), with more to come.

We would like to create a text file with the Rulesets and Objects. Then implement them using the CLI.

I am fairly new to Palo Alto (~3 Days) and was thinking 'there has to be a way to use a batch process to implement large rulesets.'

All help is appreciated.

Regards,

Jasper

Re: Palo Alto Configuration Using CLI

Raido_Rattameister — Sat, 04 Jun 2016 19:30:45 GMT

If you make any change either in GUI or CLI then this change is done in "candidate config"

It is instantly visible on GUI aswell.

When you commit then it is placed into "running config" and it will survive reboots.

Re: Palo Alto Configuration Using CLI

jasfree — Sat, 04 Jun 2016 20:06:06 GMT

Thank you Raido.

The would eliminate a lot of my problems during the implementation of the Rulesets.

Regards,

Jasper

Re: Palo Alto Configuration Using CLI

Raido_Rattameister — Sat, 04 Jun 2016 20:20:31 GMT

Great.

Just keep in mind that web interface shows "candidate config" that might not be active on dataplane.

So if someone does change either through CLI or GUI and forgets to commit then you see new config in interface but firewall is acting according to setup that is in running config.