topic Re: running-config to candid-config OR candid-config to running-config in General Topics

running-config to candid-config OR candid-config to running-config

learner4397 — Wed, 19 Dec 2018 18:51:59 GMT

Hello All,

Kindly help understand the concept.

I am preparing for my PCNSE and I was reading through the a manual provided by Palo Alto (EDU-255).

Under Configuration Operations, at one point the document reads that “the running configuration is copied to a candidate configuration during firewall startup”. On the very next page, the document reads that “at boot time the latest configuration on disk is loaded to the candidate configuration in control-plane memory. An auto-commit copies the candidate configuration to the running configuration in control-plane memory. The running-configuration in control-plane memory is then pushed to the data-plane memory”.

Thanks,

learner

Re: running-config to candid-config OR candid-config to running-config

reaper — Fri, 21 Dec 2018 13:53:16 GMT

the first description is the same as the second, only with fewer steps 🙂

upon reboot the candidate configuration is purged. once the device is booted, the stored config (running-config.xml) is loaded as candidate-config.xml and then pushed onto the chipset

the running and candidate are 2 files, while the 'live' config is the machine translated snippets that are loaded onto the chips/in memory to do their job

the running-config.xml is the master file

hope this makes sense

Re: running-config to candid-config OR candid-config to running-config

MP18 — Fri, 21 Dec 2018 15:51:20 GMT

When you say that upon reboot candidate config is purged does it mean that it gets purged with runnin config ?

live config is always the running config?

Re: running-config to candid-config OR candid-config to running-config

reaper — Fri, 21 Dec 2018 16:06:03 GMT

it is removed from 'working' memory (on the management plane) and overwritten with the running-config upon reboot

running-config is the config that has been pushed upon the dataplane processes so running-config is always the configuration that is being enforced by the firewall, while the candidate config is the 'admins playground' for as long as the admin does not commit

Re: running-config to candid-config OR candid-config to running-config

learner4397 — Sat, 22 Dec 2018 01:30:35 GMT

Thank you!

You cleared the doubt.

regards,

learner