Hi @acc6d0b3610eec313831f7900fdbd235 Thank you for detailed explanation. Understood about the recommendations. My question: How is this feasible in an enviroment if I have 50+(not including passive pair) firewalls . I also thought panorama might be of help here. But in case, if a update is revoked and you try to push dynamic updates via panorama, it fails horribly. For example: We have dynamic updates set to check daily, with a threshold of 8 hrs. 709 was relased( threshold was set to 8 hrs ). After 8 hrs 709 is installed on every firewall. ~14 hrs later PA decides to revoke 709. Next, all I can think of is panorama, I do check updates (I find 708 is latest/available). Awesome, lets try now to push 708 to all firewalls,. Panorama complains, the firewalls have better version than what it am trying to push. EPIC Fail...!!! Only thing I can do is to Login to every firewall and push it back to 708 or wait for 24 hrs before the firewall updates itself. My 0.02$ is PA should make emergency and regular updates different in the dynamic updates tab, rather than combining them and pushing them once, just how checkpoint does. Hope I made sense.
... View more
