topic Re: candidate configuration in General Topics

candidate configuration

simsim — Sat, 10 Feb 2018 05:04:02 GMT

Hi,

What is candidate configuration and what is the purpose of candidate configuration ?

What is the differnece between save candidate configuration and the save using the button on the top right corner ?

What is the differnce between save candidte configuration and commit

Thanks

Re: candidate configuration

Mick_Ball — Sun, 11 Feb 2018 10:52:22 GMT

Any changes made to the firewall are written to the candidate config.

they are not applied until you select commit.

if you make a change to the firewall and it is rebooted before you commit, the changes will be lost, unless you save the candidate config first....

if you commit after reboot then the saved candidate config will be applied...

i can see no difference in doing this from setup or the save icon.

Re: candidate configuration

reaper — Mon, 12 Feb 2018 07:41:02 GMT

the save is actually a soft save and will not survive reboot, both buttons do the same thing

The candidate config allows you to change, verify, redo, correct, experiment,... anything you need to do without interfering with your dataplane, until you decide your configuration is good and hit the 'commit' button at which time it will be loaded to the dataplane and ipacket nspection decissions are made on it

in PAN-OS 8.0 the save option has been enhanced so that you can more easily choose to save, and revert to your last save, while working on the candidate config:

Re: candidate configuration

Mick_Ball — Mon, 12 Feb 2018 08:07:08 GMT

@reaper, many thanks for that information, i must have misread the pan documentation that clearly states the following...

Clicking on 'save' (see screenshot below) causes the system to save the candidate configuration to a hidden file, enabling the un-committed changes to survive a reboot or management server restart.

Maybe this applied to an older version....

Re: candidate configuration

reaper — Mon, 12 Feb 2018 09:25:36 GMT

Hi @Mick_Ball

no you're right, it used to not survive reboot,m but it does now! 🙂