yes but if the cluster had fail-over... why shouldn't this process be "wise" ?? i think there are a lot of tasks regarding cluster operation and a lot about panorama that could have been done better and need some improvement. lets say for example the update thing or when panorama should manage HA in active passive... so first you have to choose in the PA device to use the MGMT interface to register to panorama, because panorama cant push policy for example to the external interface.... amm actually it can be done, but the commit will commit only on the active device... it is like Panorama doesn't know (or should i say, does not check in the information it already has) that we are talking about a cluster, so i will send a commit to the active device with the SN of both of the device, and the best thing is that even when i push policy using the "external" interface, the active device wont issue a commit to the passive device like it will normally do when you commit locally. it is like those little thinks that are missing and you say how they didn't think about that
... View more
