topic Re: Panorama Dynamic Update overlap in General Topics

Panorama Dynamic Update overlap

nicholasstone — Thu, 06 Apr 2017 05:43:51 GMT

Given the best-practices for Dynamic updates here, how do i configure this in Panorama and not have the commit warning for deployment schedule overlapping with 5 mins of another?

Its always going to be the case where Wildfire checking every minute will overlap with all other schedules at some point in time...

I thought Panorama in 7.1 could multi-thread scheduled updates? or am I thinking of something else?

Re: Panorama Dynamic Update overlap

bradk14 — Thu, 06 Apr 2017 09:12:20 GMT

with 7.1, the ability to queue commit jobs was added, so you will no longer be blocked from executing a commit if another job is currently being processed.

and if I'm not mistaken, commits actually take precedence over other types of jobs such as EDL refreshes.

Re: Panorama Dynamic Update overlap

nicholasstone — Thu, 06 Apr 2017 09:19:01 GMT

Commit is not the issue, the issue is that after a successful commit there is a warning message that says the Dynamic Update schedule overlaps. How do I make this go away?

Re: Panorama Dynamic Update overlap

bradk14 — Thu, 06 Apr 2017 09:35:53 GMT

oh gotcha. personally I don't think that's something you'd have to worry about in the real world (you can always check the system logs to be sure), but to eliminate the warning altogether, I'd think you'd have to reduce your wildfire updates.

personally I couldn't consider 1 minute updates because it seems to me like it would performing the update literally constantly (but you apparently already realize this).

the way to schedule them is simply to use the offset option available below the frequency field. you can choose every 30 minutes, but rather than make it :00 and :30 past the hour, you make it :07 and :37 for example.

Re: Panorama Dynamic Update overlap

nicholasstone — Mon, 10 Apr 2017 05:05:38 GMT

if that were the case, then why would the best practise guide recommend 1 min? the idea behind 0 day protection, in my opinion, would be getting as close to a constant stream of updates as possible. that would make sense to why the interval dropped from 15 mins to 5 mins recently.

the config is accepted by the firewalls, just the message is annoying and will be questioned by the end customer.

perhaps this is one for TAC...