what is the difference between "commit to panorama" and "save changes"?

[perumalj]

I do see commit and config options in Panorama. I am aware that commit option is used to push configuration to Panorama and then to Managed firewalls. I would like to know when to use "save changes" and what is it for under config options.if possible , Please also explain about Lock option. Lock option is used to lock commit when multiple users try to push configuration changes at the same time but I would like to know whether we need to save changes we made or commit to Panorama if I want to handover to the other user to do commit. 

And also let me know whether we need to commit to panorama or save changes before I remove lock 

[nikoolayy1]

Hello  ,

I suggest passing the palo alto trainings below:

EDU-110 and EDU-120 for PAN-OS 9.0 | Palo Alto Networks

Also CBT nuggets have a new course for Palo Alto and it is great

[reaper]

to start from the beginning, there are 2 configuration versions 'in play' at all timers.

- running is what is actually 'live'' on your system

- candidate is where you're making changes and doing things before making something 'live'

the candidate config is volatile, if you reboot the device it resets to running. if you however want to save your changes for later, don't want to risk losing your changes due to an unexpected reboot, but dont want to push config to running just yet, you can opt to save changes. that will write your changes to a snapshot. if there is a reboot which resets your changes, you can load the snapshot and continue where you left off

if you commit your changes, theyre obviously saved so you dont need to manually save them again

the lock options:

- config lock prevents other admins from making changes, this is useful when you're making very broad changes that could get conflicted if another admin makes a change

-commit lock prevents other admins from committing, good for when you're making small but very critical (virtual router/interface or HA config for example) and want to prevent inadvertently pushing unfinished configuration to a device

tl;dr you don't need to save changes unless you intend to leave uncommitted config 'out' for a long time (risking a reboot somewhere along the way)

hope this helps, check out my books