Can I verify a config before doing a commit?

[dabels]

I was writing a rule to allow ciscovpn to only certain addresses, so I added a destination and the application I chose was ciscovpn.  I added it to the policy and then did a commit.   it came back with messages saying that ciscovpn needed ike to function and it was denied in the default deny.  so I added ike and did a commit,  and got a message saying that it needed ssl, so i added ssl and got another message.   what I would like to do is have some way to know all of the possible needs before doing a commit so that I don't spend all day doing one thing...   so is there a way to verify the config before doing a commit?

[zarina]

You can try using the validate candidate config under Device -> Setup -> Operations

[rmonvon]

Hi...The validate config feature will only display errors but not app dependency which is described here.

One method is to allow all applications on tcp/udp ports that the ciscovpn operate on.  Then review the traffic log to see which apps are detected for the ciscovpn and allow only those apps.

Thanks.