Palo alto candidate configuration vs running conf

[Sarou22]

Hello,

I don't understand the difference between candidate configuration and running configuration.

Before committing when I'm making changes it's the running configuration and when I commit it becomes candidate configuration?

Another question. I've made a commit and I'd like to rollback how do I do it?

[BPry · Accepted solution]

@Sarou22,

The candidate-config is the thing that you're actually modifying when you're working on the device prior to when you commit. So if I make a user named "TestUser" as an example, that user only exists in the candidate configuration until I commit that configuration change.

The running-config is what the device actually has active and what it's using to apply current policy. This configuration doesn't include any changes that you haven't committed to the device, but rather only what is currently active for the device to enforce.

The most basic way to explain this is like this:

• Running Configuration = The configuration that is active on the device and actually being enforced.
• Candidate Configuration = The configuration that you would be making any changes to that has yet to be committed and made active on the device.

[MP18 · Accepted solution]

@Sarou22 

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000HAHXCA4

For rollback commit you either need to save the config before doing the commit or you revert to previous changes.

Please see this

Revert Firewall Configuration Changes (paloaltonetworks.com)

Any more questions please let me know?

Regards