Disable possibility of Commit

[RCastro]

Hi, I want to know if there is some way to know if

In which scenario, we can guarantee that a PaloAlto device united to Panorama (For "x" reason) can give a COMMIT that involves a complaint from the Business Unit.

Or there is a button ("Disable" in Panorama) that will help us with something similar and only enable when something specific is required

Because we have a PA with a Panorama and there is no way that it looses it administration

Thanks ind advance

[OtakarKlier]

Hello,

If you create a custom admin role, you should be able to prevent the user that is logged in from committing any changes. This is a screen shot or the builtin auditadmin role:

Was this what you were looking for?

Regards,

[RCastro]

Thanks for the response but the problem is more in the side of Panorama, if there is some configuration in which we may disable the option of commit or to enable the option of commit when neccesary

[OtakarKlier · Accepted solution]

Hmm, perhaps the use of commit locks?

https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/firewall-administration/use-the-web-...

[RCastro]

Thanks !!