IT configuration and change management

[mgeorge]

Hi, Could someone help me with info on implementing configuration and change management for PA firewall's deployed in a large organization .

Thanks

[pulukas]

Do you already have a change management software system deployed or are you looking for options that include Palo Alto devices?

Or are you just looking to setup the processes and procedures without a specific software to manage and control them?

[jdub_cloud]

Reviving this post. 

We are also looking for ways to improve our change management procedures to satisfy compliance requirements. 

Currently, we are using Panorama to manage our firewalls and use the "Commit Comment" section to include Jira ticket numbers where we can reference the config changes and approvers. We also use the "Audit Commit" but that only applies to policy changes.

Unfortunately, this has many limitations:

1. It's easy to forget to add the ticket number
2. There is no explicit way for another team member to approve the change in Panorama/FW.

3. There are times when commits are generated without the comment addition (i.e. upgrades)

Are there any ideas to overcome these challenges? 

We'd love to use git, but that would require a heavy lift to create a CI/CD pipeline, and potentially change how we use Panorama. We are happy with Panorama, but just wish there were better features to incorporate change management.

Other ideas?

Thanks!!