This Nominated Discussion Article is based on the post "Palo Alto Firewall Commit Error" by @Dhirajjagdale and answered by @BPry.   Hi,   I'm getting the below Validation error after committing the changes in firewall.   As I checked there is no user in the local user database. Please help to identify the issue.      Validation Error: mgt-config -> users -> operator is invalid. it is a system user name mgt config -> users is invalid Commit failed   Most systems usually have a list of reserved words that you can't use as they are used by the system internally.   In this case, the error isn't complaining about a local user, but rather about an administrator account that you created using  such a reserved word.   The name "operator" is not a feasible name to configure as a user, application, object, etc as it is used by the firewall internally. Deleting the user or renaming it will solv your problem.

  Packet Buffer Protection is one of the first lines of defense. Find out why it's important and how it can improve your security posture.

Searching for the obvious can sometimes be hard. You simply might have overlooked something or you might have never needed it before. Things can become especially tricky when you have a security policy that's several hundreds of rules long.

Palo Alto Networks' Commit and Config Locks are important features that help ensure the integrity of network configurations and prevent unauthorized changes.

This Nominated Discussion Article is based on the post "CLI configuration of adding interface to virtual router" by @nowayout and responded to by @aleksandar.astardzhiev  . Read on to see the discussion and solution!   When adding an interface into VR using CLI, do I need to copy all the existing interfaces currently in the VR and then add this new interface into the list ?   For example, current default virtual router has two interface ethernet1/1 and ethernet1/2, I want to add another interface ethernet1/3 what I need to do is only "set network virtual-router default interface [ ethernet1/3 ]" or I have to do "set network virtual-router default interface [ ethernet1/1 ethernet1/2 ethernet1/3] If the latter one, it'll involve some programming work if doing automation in real world environment as we don't know what interfaces already in the virtual router, so need to get the list first and then add the interface into the list and issue the set command.   You don't need to list existing interfaces when adding new one to virtual-router. If you run the following command it will add to the existing list, and will not override it:   > set network virtual-router default interface ethernet1/3   The square brackets are options in your case, they are needed if you want to add multiple interfaces with single command.   Even if you are adding multiple interfaces with [ ethernet1/4 ethernet1/5 ethernet1/6 ], it will still only add those three without overriding or removing any interface from the list.   Now if you want to remove interface/s from the list you either remove interface one by one or all interfaces at once:   # will remove only one interface from the list and the rest will remain > delete network virtual-router default interface ethernet1/3 # will remove all interface from virtual router > delete network virtual-router default interface