Pn commit and push affect the local candidate configuration of the wall

[Felixcao]

The customer has a vm-300 that is configured through panorama management and configure.

An accident occurred where the administrator configured a nat police configuration on the vm-300 August 22,

, but there was no commit and no task modifications were made.

The September 5th, the administator configured an ldap profile for this vm-300 through panorama and committed and pushed it,

A strange thing has happened, the newly added nat police configuration on the vm-300 has changed from a candidate configuration to a running configurationAccording to my understanding, the configuration of pn push does not necessarily change the candidate configuration of the wall to the running configuration

Refer to screenshot:

Customer panorama: 10.2.3                vm-300: 10.2.3

I tested it myself using version 11.0.2 of pn, and the same situation occurred,

Does anyone know that this is a normal design? Is it still possible to have a version bug

[PavelK]

Hello @Felixcao

thanks for post!

The scenario you described is expected behavior. When the configuration is pushed from Panorama to managed Firewall the commit all is performed which also commits local uncommitted configuration.

Kind Regards

Pavel

[JeremyGlaus · Accepted solution]

There is a setting in panorama to prevent this behaviour:

Navigate to Commit -> Push to devices -> Edit Selections and uncheck "Merge with Device candidate config".

There is also the setting "Force template values" if you want to override the local changes.

Best wishes

Jeremy

[PavelK]

Hello @JeremyGlaus

thank you for stepping in! The option you pointed out is indeed answer to the question and has an official KB: How Configuration Change is Being Applied Depending on “Merge with Candidate Config” Commit Option. I am going to marked your answer as an accepted solution.

Thank you and Regards

Pavel  

[JeremyGlaus]

Hey @PavelK 

Nice, thank you very much!

Have a good day and best wishes 🙂

Jeremy