Panorama - Remote PA52xx

[mcronin]

I have not had much hands on with Palo Alto in particular Panorama but I would like to ask for some help -

We have Panorama at our central Data Center which is used to Configure our remote PA52xx's. 

If Panorama is used to apply policy to a firewall and there is a need to rollback a recent policy change which of these are possible.

1) Rollback the change via Panorama   -                                  This can be done!!  I know this at least -

2) Rollback the change via local web access to mgmt port  -  Is this possible?

3) Rollback the change via local console port   -                     Is this possible?

4) Are there any other ways to rollback the change?

If you are able to answer 2,3 or 4 can you provide a brief summary of the process to rollback please.

Also -

Whilst working with Juniper equipment there is a "Commit Confirmed" command which allows you to commit a config

which will automatically roll back after 10 minutes if no action is taken.  This helps if your change cuts you off from the remote site.    Is there a Palo Alto equivalent command available for v8 , v9

Thanks

Mark              

[BPry]

@mcronin,

There isn't anything like a commit confirmed built natively into PAN-OS. You can duplicate the functionality through the API relatively easily through a series of configuration checks, but to be effective you would need to have one locally paired with the PA-52xx since you don't know if the change will break any of your remote connections to the device. This likely isn't something you would have available if you are using Panorama, but it is an option an it works quite well.

As for the rollback of changes I don't believe the process would be any different than a firewall that isn't managed by the firewall. You simply log in via SSH or the GUI and load the last working configuration version and commit to restore operations.