Does Config Lock disable the "OK" button on changes?

Announcements

ATTENTION Customers, All Partners and Employees: The Customer Support Portal (CSP) will be undergoing maintenance and unavailable on Saturday, November 7, 2020, from 11 am to 11 pm PST. Please read our blog for more information.

Reply
Highlighted
L4 Transporter

Does Config Lock disable the "OK" button on changes?

I thought a Config Lock is supposed to disable the "OK" button when making configuration changes.  Could someone please confirm that's the case?


Accepted Solutions
Highlighted
L6 Presenter

Doesn't disable the OK but it does relay the block upon clicking said OK button.

Blocks other administrators from making changes to the configuration. This type of lock can be set globally or for a virtual system. It can be removed only by the administrator who set it or by a superuser on the system. 

10-23-2012 11-52-45 AM.png

View solution in original post


All Replies
Highlighted
L6 Presenter

Doesn't disable the OK but it does relay the block upon clicking said OK button.

Blocks other administrators from making changes to the configuration. This type of lock can be set globally or for a virtual system. It can be removed only by the administrator who set it or by a superuser on the system. 

10-23-2012 11-52-45 AM.png

View solution in original post

Highlighted
L4 Transporter

Thanks for the clarification.  One additional question, can a Superuser make changes even if there's a Config Lock taken by another user?  The reason for that question is because my PAN is allowing the SU to make changes to the config even though there's a Config Lock taken.

Highlighted
L6 Presenter

On my test, I was attempting to make a config change with another 'superuser' account and was prompted with that message. :smileyhappy:

Highlighted
L4 Transporter

What version PAN-OS are you using?

Highlighted
L6 Presenter

sw-version: 4.1.8-h1

Highlighted
L4 Transporter

Ok... something's very weird.  I am also running 4.1.8 and yes, I am getting the lock dialog box when I tried to create a new Address Object, just like you show in your screenshots.  However, if it allows me to create a new Administrator account under the Device -> Administrators menu. Hmmm!!!!  Can you try it and let me know if you get the same results?

Highlighted
L6 Presenter

Admin (superuser) locks config. 'Renato' superuser logs in and attempts to create another superuser (testadmin) but failing to create it due to config lock.

renato                    10.10.10.1      Web 10/23 10:58:29     00:07:49s

admin                   172.16.20.24      CLI 10/20 09:54:38     74:49:47s

[2012/10/23 12:59:52]

<request cmd="set" cookie="2031488784055045" obj="/config/mgt-config/users/entry[@name='testadmin']" newonly="yes">

  <permissions>

  <role-based>

  <superuser>yes</superuser>

  </role-based>

  </permissions>

  <phash>$1$orjkikoe$J.X5P497nbJ5Uty9yNrtc0</phash>

</request>

<response status="error" code="13"><msg><line>Configuration is locked by admin</line></msg></response>

Highlighted
L4 Transporter

Here's my scenario...

Admin (superuser) logs in using Firefox browser. Admin takes the Config Lock.

Mickey (superuser) logs in using IE browser. Mickey attempts to create another superuser (testadmin) and SUCCEEDS!  Mickey also attempts to create a new Address object and gets an error message due to the config lock.  Mickey also attempts to change the Application on a Security Policy and SUCCEEDS!

Don't understand why?

Highlighted
L4 Transporter

It's probably due to the Device/Network vs Object/Policy config.

The lock must only be honored when making changes to the object/policy side of the config. When you add a new user, you're modifying the device config.

It would be interesting to see the results if you added the object first, and then tried to create a new user.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!