Does Config Lock disable the "OK" button on changes?

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Does Config Lock disable the "OK" button on changes?

L4 Transporter

I thought a Config Lock is supposed to disable the "OK" button when making configuration changes.  Could someone please confirm that's the case?

1 accepted solution

Accepted Solutions

L6 Presenter

Doesn't disable the OK but it does relay the block upon clicking said OK button.

Blocks other administrators from making changes to the configuration. This type of lock can be set globally or for a virtual system. It can be removed only by the administrator who set it or by a superuser on the system. 

10-23-2012 11-52-45 AM.png

View solution in original post

9 REPLIES 9

L6 Presenter

Doesn't disable the OK but it does relay the block upon clicking said OK button.

Blocks other administrators from making changes to the configuration. This type of lock can be set globally or for a virtual system. It can be removed only by the administrator who set it or by a superuser on the system. 

10-23-2012 11-52-45 AM.png

Thanks for the clarification.  One additional question, can a Superuser make changes even if there's a Config Lock taken by another user?  The reason for that question is because my PAN is allowing the SU to make changes to the config even though there's a Config Lock taken.

On my test, I was attempting to make a config change with another 'superuser' account and was prompted with that message. Smiley Happy

What version PAN-OS are you using?

sw-version: 4.1.8-h1

Ok... something's very weird.  I am also running 4.1.8 and yes, I am getting the lock dialog box when I tried to create a new Address Object, just like you show in your screenshots.  However, if it allows me to create a new Administrator account under the Device -> Administrators menu. Hmmm!!!!  Can you try it and let me know if you get the same results?

Admin (superuser) locks config. 'Renato' superuser logs in and attempts to create another superuser (testadmin) but failing to create it due to config lock.

renato                    10.10.10.1      Web 10/23 10:58:29     00:07:49s

admin                   172.16.20.24      CLI 10/20 09:54:38     74:49:47s

[2012/10/23 12:59:52]

<request cmd="set" cookie="2031488784055045" obj="/config/mgt-config/users/entry[@name='testadmin']" newonly="yes">

  <permissions>

  <role-based>

  <superuser>yes</superuser>

  </role-based>

  </permissions>

  <phash>$1$orjkikoe$J.X5P497nbJ5Uty9yNrtc0</phash>

</request>

<response status="error" code="13"><msg><line>Configuration is locked by admin</line></msg></response>

Here's my scenario...

Admin (superuser) logs in using Firefox browser. Admin takes the Config Lock.

Mickey (superuser) logs in using IE browser. Mickey attempts to create another superuser (testadmin) and SUCCEEDS!  Mickey also attempts to create a new Address object and gets an error message due to the config lock.  Mickey also attempts to change the Application on a Security Policy and SUCCEEDS!

Don't understand why?

It's probably due to the Device/Network vs Object/Policy config.

The lock must only be honored when making changes to the object/policy side of the config. When you add a new user, you're modifying the device config.

It would be interesting to see the results if you added the object first, and then tried to create a new user.

  • 1 accepted solution
  • 4285 Views
  • 9 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!