Panorama Dynamic Update overlap

[nicholasstone]

Given the best-practices for Dynamic updates here, how do i configure this in Panorama and not have the commit warning for deployment schedule overlapping with 5 mins of another?

Its always going to be the case where Wildfire checking every minute will overlap with all other schedules at some point in time...

I thought Panorama in 7.1 could multi-thread scheduled updates? or am I thinking of something else?

[bradk14]

with 7.1, the ability to queue commit jobs was added, so you will no longer be blocked from executing a commit if another job is currently being processed.

and if I'm not mistaken, commits actually take precedence over other types of jobs such as EDL refreshes.

[nicholasstone]

Commit is not the issue, the issue is that after a successful commit there is a warning message that says the Dynamic Update schedule overlaps. How do I make this go away?

[bradk14]

oh gotcha. personally I don't think that's something you'd have to worry about in the real world (you can always check the system logs to be sure), but to eliminate the warning altogether, I'd think you'd have to reduce your wildfire updates.

personally I couldn't consider 1 minute updates because it seems to me like it would performing the update literally constantly (but you apparently already realize this).

the way to schedule them is simply to use the offset option available below the frequency field. you can choose every 30 minutes, but rather than make it :00 and :30 past the hour, you make it :07 and :37 for example.

[nicholasstone]

if that were the case, then why would the best practise guide recommend 1 min? the idea behind 0 day protection, in my opinion, would be getting as close to a constant stream of updates as possible. that would make sense to why the interval dropped from 15 mins to 5 mins recently.

the config is accepted by the firewalls, just the message is annoying and will be questioned by the end customer.

perhaps this is one for TAC...