Panorama - Remote PA52xx

Announcements

ATTENTION Customers, All Partners and Employees: The Customer Support Portal (CSP) will be undergoing maintenance and unavailable on Saturday, November 7, 2020, from 11 am to 11 pm PST. Please read our blog for more information.

Reply
Highlighted
L0 Member

Panorama - Remote PA52xx

I have not had much hands on with Palo Alto in particular Panorama but I would like to ask for some help -

We have Panorama at our central Data Center which is used to Configure our remote PA52xx's. 

 

If Panorama is used to apply policy to a firewall and there is a need to rollback a recent policy change which of these are possible.

 

1) Rollback the change via Panorama   -                                  This can be done!!  I know this at least -

2) Rollback the change via local web access to mgmt port  -  Is this possible?

3) Rollback the change via local console port   -                     Is this possible?

4) Are there any other ways to rollback the change?

 

If you are able to answer 2,3 or 4 can you provide a brief summary of the process to rollback please.

 

Also -

Whilst working with Juniper equipment there is a "Commit Confirmed" command which allows you to commit a config

which will automatically roll back after 10 minutes if no action is taken.  This helps if your change cuts you off from the remote site.    Is there a Palo Alto equivalent command available for v8 , v9

 

Thanks

Mark              

Tags (1)
Highlighted
Cyber Elite

@mcronin,

There isn't anything like a commit confirmed built natively into PAN-OS. You can duplicate the functionality through the API relatively easily through a series of configuration checks, but to be effective you would need to have one locally paired with the PA-52xx since you don't know if the change will break any of your remote connections to the device. This likely isn't something you would have available if you are using Panorama, but it is an option an it works quite well.

 

As for the rollback of changes I don't believe the process would be any different than a firewall that isn't managed by the firewall. You simply log in via SSH or the GUI and load the last working configuration version and commit to restore operations. 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!