Enhanced Security Measures in Place: To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.
02-20-2017 11:55 AM
Our Panorama is running PANOS v7.1.6 and is configured to "Automatically Acquire Commit Lock". We have several firewall system administrators. If anyone of us makes a change, a commit lock is automatically taken for the user who makes the change. Two questions:
1.) If I make a change, a commit lock appears for me. If another administrator makes a change, a commit lock appears for him. If I attempt to remove my commit lock so that the other administrator can apply my changes and his, I encounter the message at the bottom until logging out of the Panorama GUI and then logging back in. Is this normal behavior?
2.) If one administrator takes a commit lock, it does not appear that any other administrator can remove that commit lock. How do you go about removing a commit lock that was created by another administrator? If he makes a change, forgets, and then leaves for vacation, how can I remove his commit lock? Surely there must be some type of override.
This is the message I encounter when attempting to remove my own automatic commit lock or the commit lock of another administrator:
Remove lock
Commit lock is not currently held by [AdminUsername]
[Close]
Thanks!
02-20-2017 12:38 PM
For question #2, any superuser should be able to remove a lock added by any user. I cannot answer your first question as we don't use automatic locks.
Regards,
Benjamin
02-20-2017 12:40 PM
2) Someone in your org should be a 'superuser' or you should have a superuser registered to the device and know what the password is. Only a superuser can remove admins commit locks.
1) I'm not sure if that is the intended behavior; are you sure that you are just trying to remove your commit lock and not trying to remove all of them on accident. If it continues to happen it might be worth talking to TAC and seeing if they have a solution for you.
02-20-2017 01:16 PM
Thank you both for the responses. Just checked... Both system administrators (myself and my coworker) are superusers. Can a superuser not remove the lock of another superuser?
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
