Searching for the obvious can sometimes be hard. You simply might have overlooked something or you might have never needed it before. Things can become especially tricky when you have a security policy that's several hundreds of rules long.

Palo Alto Networks' Commit and Config Locks are important features that help ensure the integrity of network configurations and prevent unauthorized changes.

This Nominated Discussion Article is based on the post "CLI configuration of adding interface to virtual router" by @nowayout and responded to by @aleksandar.astardzhiev  . Read on to see the discussion and solution!   When adding an interface into VR using CLI, do I need to copy all the existing interfaces currently in the VR and then add this new interface into the list ?   For example, current default virtual router has two interface ethernet1/1 and ethernet1/2, I want to add another interface ethernet1/3 what I need to do is only "set network virtual-router default interface [ ethernet1/3 ]" or I have to do "set network virtual-router default interface [ ethernet1/1 ethernet1/2 ethernet1/3] If the latter one, it'll involve some programming work if doing automation in real world environment as we don't know what interfaces already in the virtual router, so need to get the list first and then add the interface into the list and issue the set command.   You don't need to list existing interfaces when adding new one to virtual-router. If you run the following command it will add to the existing list, and will not override it:   > set network virtual-router default interface ethernet1/3   The square brackets are options in your case, they are needed if you want to add multiple interfaces with single command.   Even if you are adding multiple interfaces with [ ethernet1/4 ethernet1/5 ethernet1/6 ], it will still only add those three without overriding or removing any interface from the list.   Now if you want to remove interface/s from the list you either remove interface one by one or all interfaces at once:   # will remove only one interface from the list and the rest will remain > delete network virtual-router default interface ethernet1/3 # will remove all interface from virtual router > delete network virtual-router default interface