revert configuration automatically

[Marivi]

I had a situation where checking log at start session box in a security policy while troubleshooting, after 2 minutes to commit changes, I lost comunication with the fw, because data plane get 100%. I would like to know if there is a commit revert command that, revert to the previous configuration in a time schedule. for example a commit that after 5 minutes revert the previous configuration, in order to recover the control?

and I have other doubt, it is recommended to filter when you do a packet capture because this could saturate the fw, is there a way to avoid this? how do you know if your filter is enough to not saturate the fw? how can I avoid this situation?

Thank you

[BPry · Accepted solution]

@Marivi,

Enabling logging at session-start is very resource intensive and not something I would recommend on smaller hardware, and really on anything close to limits as is. As of now that sort of feature is not built into PAN-OS, however I do believe there is an open Feature Request for it to be added (always found this missing to be odd, since PAN kind of started with a lot of Juniper dudes and gals). 

Filtering on a packet-capture shouldn't add that much overhead, but you are going to consume more resources than filtering it after a capture. It sounds like you added a lot of load to your firewall (via <log-start>yes</log-start> and turning on a filtered packet capture) while you were already higher up your system resources.