Enhanced Security Measures in Place:   To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.

Panorama Dynamic Update overlap

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Panorama Dynamic Update overlap

L2 Linker

Given the best-practices for Dynamic updates here, how do i configure this in Panorama and not have the commit warning for deployment schedule overlapping with 5 mins of another?

 

Its always going to be the case where Wildfire checking every minute will overlap with all other schedules at some point in time...

I thought Panorama in 7.1 could multi-thread scheduled updates? or am I thinking of something else?

4 REPLIES 4

L4 Transporter

with 7.1, the ability to queue commit jobs was added, so you will no longer be blocked from executing a commit if another job is currently being processed.

 

and if I'm not mistaken, commits actually take precedence over other types of jobs such as EDL refreshes.

--
CCNA Security, PCNSE7

Commit is not the issue, the issue is that after a successful commit there is a warning message that says the Dynamic Update schedule overlaps. How do I make this go away?

oh gotcha. personally I don't think that's something you'd have to worry about in the real world (you can always check the system logs to be sure), but to eliminate the warning altogether, I'd think you'd have to reduce your wildfire updates.

 

personally I couldn't consider 1 minute updates because it seems to me like it would performing the update literally constantly (but you apparently already realize this).

 

the way to schedule them is simply to use the offset option available below the frequency field. you can choose every 30 minutes, but rather than make it :00 and :30 past the hour, you make it :07 and :37 for example.

 

Capture.JPG

 

 

 

 

--
CCNA Security, PCNSE7

if that were the case, then why would the best practise guide recommend 1 min? the idea behind 0 day protection, in my opinion, would be getting as close to a constant stream of updates as possible. that would make sense to why the interval dropped from 15 mins to 5 mins recently.

 

the config is accepted by the firewalls, just the message is annoying and will be questioned by the end customer.

 

perhaps this is one for TAC...

  • 3607 Views
  • 4 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!