Any chance of an Automated Rollback on Palo Alto firewalls?

[TomMeadows]

Hi-

Im familiar with Juniper equipment which all have the option to 'commit confirm' which automatically reverts the config change if a 2nd commit is not made within a certain period (default 10 mins I think).

Its a life-saver if you have to administer remote devices, bbvsince if your change broke connectivity for any reason, in 10 minutes time, your changes get revoked.

I now have to administer a couple of remote Palo Alto systems.

I don't know of any way to automate a rollback in absence of confirmation.

Does anyone know any way to do this?

Does anyone know if this is on the PANOS roadmap?

Thanks

Tom

[reaper]

Hi Tom

I can't comment on roadmap, but I do knoiw there is a feature request for this:

FR ID: 204

If you reach out to your sales team, they can add your vote to this feature to have it added

[pulukas]

Note how low that FR number is.  We have been asking for "commit confirmed" for a long time.

But please contact your Sales Engineer and add your company vote to FR 204.  Keep hope alive.

[JimmyHolland]

Just to say for future readers, that a feature for this was released in 9.1 that checks connectivity back to Panorama post-commit: https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-new-features/panorama-features/automatic-panoram...

[KennethMcRae]

That's a nice added feature, but not quite auto rollback (unless commit confirmed).  In a situation where PANs are managed without Panorama, if you lose access with no OOB, you are hosed until you can get remote hands or travel onsite.

[BPry]

@KennethMcRae,

Just throwing this out there as an option, but if you have a small node on-site you could use to run a script you can automate a configuration roll-back through the API fairly easily. Ideally this actually gets implemented directly in PAN-OS, but it's a viable option for those that don't use Panorama who want this functionality.