global protect timeout increase through Panorama CLI

[Deepak25]

We are managing the firewall through Panorama. We want to increase the global protect timeout as mentioned in below article.

https://knowledgebase.paloaltonetworks.com/kCSArticleDetail?id=kA10g000000PNma

Can we make the changes directly through local firewall CLI ?

[PavelK]

Thank you for the post @Deepak25

If current Global Protect configuration is pushed by Template you will not be able to make this change locally on Firewall unless you override it: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cld5CAC

I would suggest to run this with override: override deviceconfig setting global-protect timeout <Timeout value>

Then you should be able to commit it locally on Firewall.

Kind Regards

Pavel

[Deepak25]

Overriding template for small change is not looks proper. What is the command to increase timeout via panorama?

[PavelK · Accepted solution]

Thank you for response @Deepak25

I see, I think I misunderstood when I was replying you.

To change that value via Panorama, you can use below command:

set template <name of the template> config deviceconfig setting global-protect timeout <time out value>

Kind Regards

Pavel

[Deepak25]

@PavelKI have set GP auth timeout via panorama by running command : set template <name of the template> config deviceconfig setting global-protect timeout <time out value>

But when I check #show deviceconfig setting global-protect in firewall CLI , changed value is not showing.

Same command if try in Panorama , I can see the changed value.

Is it expected ?

[PavelK]

Thank you for reply @Deepak25

This is not expected. Could you please make sure that Template you made a change to is bound to the Template Stack where the target Firewall you want to make change is associated to? Also, could you confirm by going to: Panorama > Managed Devices > Summary > [Navigate to target Firewall] > Check status of: "Template Last Commit State" to make sure this has been pushed without any error.

Kind Regards

Pavel

[Deepak25]

Running the command on firewall resolved the issue. I can see increased timeout value on firewall and radius authentication going to secondary radius server when primary radius server is unreachable.