topic Re: Schedule a rollback to last known good configuration in General Topics

Schedule a rollback to last known good configuration

nawaza — Wed, 10 Jan 2018 13:54:37 GMT

Hi all,

Is it possible to rollback to 'last known good' configuration, or even previously running config.

Say for example I make some changes and issue a commit, then subsequently lose connectivity. Is there a mechanism to schedule a rollback to previously running config after say 5minutes?.

Many thanks

Ajaz Nawaz

JNCIE-SEC No. 254

CCIE-RS No. 15721

Re: Schedule a rollback to last known good configuration

BPry — Wed, 10 Jan 2018 13:57:25 GMT

@nawaza,

From a straight feature standpoint; not that I know of. I'm assuming that this is on a remote Palo (otherwise it wouldn't really matter) so in that case you could use a local computer within that firewalls network to script this function via the API.

Re: Schedule a rollback to last known good configuration

OtakarKlier — Wed, 10 Jan 2018 22:22:39 GMT

Hello,

Not sure what changes you are making, however if they are policies, then you add a new policy above the one you want to modify and check the logs to see if the new one gets hit. WIth routing now much to do there but to have hands on the device :(.

Regards,

Re: Schedule a rollback to last known good configuration

nawaza — Thu, 11 Jan 2018 17:09:13 GMT

Thanks for the replies.

Its a valuable feature so am somewhat surprised it isn't already there...

Juniper seemed to have it nailed.

https://www.juniper.net/documentation/en_US/junos/topics/task/configuration/junos-cli-configuration-activating-after-confirming.html

Will probably make its way into the code I imagine at some point.

Re: Schedule a rollback to last known good configuration

pulukas — Sat, 13 Jan 2018 15:40:51 GMT

The feature is called "commit confirmed" in the Juniper world. There is a feature request pending for a while now.

FR ID 204

Contact your sales engineer and have your company also vote for this feature.

Previous discussion

https://live.paloaltonetworks.com/t5/General-Topics/commit-confirmed-X-on-PaloAlto-firewall/m-p/45758#M33637

Re: Schedule a rollback to last known good configuration

nawaza — Mon, 15 Jan 2018 13:24:49 GMT

Hi Steve - thanks for the info.

I could be accused of being over-paranoid here but its understandable why any vendor would be reluctant to introduce such a feature as its facilitates migrating to a different vendor.

Kind regards

Ajaz

Re: Schedule a rollback to last known good configuration

pulukas — Thu, 18 Jan 2018 00:37:34 GMT

Commit confirmed has nothing to do with migration.

Have you ever applied a new configuration to a network device and found yourself suddenly disconnected and cut off from the remote device because there was an error you failed to notice in your configuration?

This is the problem that commit confirmed solves. You commit the new configuration.

If you don't confirm that all is well in the alloted time, the configuration automatically rolls back to the previous settings restoring access.