Feature suggestion: better candidate configuration highlighting and testing

[AGrijalba]

These are some suggestions that would help a lot when creating new rules:

1. Highlight modified uncommited policies.

You may argue that a user should know what the is chaning, but the problem is multiuser.

When a user has a candidate rule, but hasn't applied it, other users cannot tell which rules have been modified.

2. Allow testing of candidate configuration.

The "Test policy match" in monitor is great, but it would be better if you could choose to test against candidate configuration. So you don't have to commit to see that your candidate was wrong.

3. Allow testing against a specific policy

Sometimes you are creating or modifying a rule in order to match certain traffic, but the rule doesn't match. It may have wrong source, destination, application, user, schedule, zone, etc, etc. You may argue that it's operator's fault if they can't find the wrong field, but it would certainly speed up configurations if the firewall assisted in this.

It would be great if you could pick a line from the traffic monitor, and a rule, and the UI told you what specific field is it NOT matching.

[JayGolf]

Hi @AGrijalba ,

Thanks for reaching out. I would recommend getting together with your account SE or representative to create a feature request. You'll send them all the details about the feature in question, and they'll take the necessary steps to have a Feature Request created for you. They'll give you a Feature Request ID (FRID). Each FRID can then be voted on by other Palo Alto Networks customers. Based on urgency, number of votes, and other factors, PAN will then decide which new features will be considered for new software and/or hardware releases.