Export/Import Named Configuration Snapshot

[IMTechSupport]

Hi everyone!

Can someone confirm that the subject can only be done by "superuser" account?

I can't find any documentation that says so. I'm wondering because "export device state" is visible for superuser account, when using a "device administrator" (dynamic role), "export device state" is not visible. Both Export and Import named configuration snapshot is available but when I try, it gives me the error "You don't have permission to view this page" / "You do not have permission to do this operation".

[IMTechSupport]

@BPry @TomYoung Hi! Appreciate it if you could share your input on this.

[TomYoung · Accepted solution]

Hi @IMTechSupport ,

I get the same error trying to export a named configuration snapshot on PAN-OS 10.1.8-h2.  Although that limitation is not listed here -> https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/firewall-administration/manage-firewall-ad... it makes sense because a device admin could import a configuration which changes his/her dynamic role.

I did find this article -> https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CljiCAC&lang=en_US&refURL=....

I don't have a lab NGFW at the moment to test the load operations, but the export operations are denied.  It makes sense that load operations don't work either.

Thanks,

Tom

[IMTechSupport]

Hi @TomYoung ,

Thank you for your response. It appears that device admin cannot do it because of the fact that they could possibly grant superuser access or change their roles.
It's just uncommon that there is no documentation. Btw, thanks again!