Nonsense configuration changes from "preview changes"

[grenzi]

Hello everybody,

  from time to time, whenever I commit small changes to my PAN firewalls, if I click on the "Preview changes" button I see (beside my changes) a list of items and configuration partials that are moved around, ie custom report configurations deleted from the top of the config and then added again in a lower portion of the config listing. Even though the overall configuration stays the same, this "fictitious" changes make the "Preview changes" feature pretty confusing and sometimes I'm unable to understand if all the changes are only cosmetic or if they hide some unwanted changes. Do any of you have the same problem? Thanks in advance.

[BPry]

@grenzi,

How are you configuring your policies? If you have multiple admins working on the system using different configuration methods, the firewall may move things around based on how the GUI actually builds things. For example; if you make a security policy in the CLI, API, or directly through the XML and then modify it via the GUI, the firewall will move elements of that security entry around. The GUI uses a set standard when building a policy, and that isn't something you would necessary follow when using another configuration method. 

What you are describing would be common if you have mixed methods of configuring the device. If all of your admins are interacting in the GUI only, I wouldn't expect to see things move. 

[grenzi]

Hi BPry,

  thank you for the explanation. As far as I know, nobody uses che CLI to make configuration changes. The admins use the WebUI only, but there is a backup job that uses the XML API to download the firewall configuration once a day. I'll try to disable the backup job and see what happens. Thanks a lot.