About mschuricht

Please contact your SE for any questions regarding roadmap. ... View more

Marcus, The rights required to use the Device > Setup > Operations are at the superuser level and there is no way to create a custom Admin Role with superuser privilege. If you need these rights you should use the superuser dynamic role instead since you are giving superuser rights in the CLI anyways. If you look at the "Role" setting in the admin role it will be set to "Device" which means the admin has rights equivalent to a deviceadmin. We are looking into eliminating offering "superuser" or "superreader" rights on the CLI under the custom admin role since it does not make sense to allow this escalation of privilege when logging in via CLI for the same admin who is a web interface deviceadmin. ... View more

50K objects is quite large. Are you actually using all of those objects? This seems like a case for consolidation if possible to subnets and ranges where applicable as well as removing any unused objects. Here is a script to identify unused objects to aid in a diagnosis: Unused and Duplicate Address Object Script I would probably recommend moving to 5.1 for 64 bit support if you cannot reduce the number of objects. 5.1 requires 4 CPU cores and 4GB RAM at minimum. For a larger config it is recommended to move to 16GB of RAM. The release notes outline the recommended requirements as well as upgrade procedure if you decide to go this route. ... View more

Please answer the following questions: How many objects do you have in total? How many device groups do you have? What is the RAM and CPU allocated to Panorama? ... View more

This will not be an officially supported method of alignment. ... View more

Anything forward looking which is a feature and not a bug would require NDA. We want to set expectations appropriately since any forward looking info can affect new or existing customer actions/decisions. Changing the alignment is not a bug. ... View more

This will work if you want to restrict log access when context switch occurs while the admin is logged in locally to a device though Panorama. The other request to restrict access without a context switch while inside the Panorama Monitor tab is a current feature request. We are tracking this request as we move forward to plan future releases. Please follow up with your SE to add to the FR if you have not already. ... View more

I asked engr to take a look at the effort of an alignment change based on this thread and a couple other requests. This does not guarantee when or if a new base image will be released since it requires QA testing and verification. I think there may have been a misunderstanding about this between Engr and Support based on some comments in an enhancement bug. I'll speak with support to make sure this is being communicated correctly. Please contact and rely on your SE regarding forward looking statements. They will be able to put you in touch with a PM who, under NDA, can make forward looking statements.  ... View more

We will look into this request and consider it as a potential feature request for a future release. This does not guarantee if or when we would release a version with changed alignment. Please move forward with the deployment today since there does not appear to be a performance issue that you are running into and the request seems to be associated with best practice for more efficient read/writes. ... View more

You could use Panorama and the script to alter the associated Security Profiles (e.g. Vuln protection, URL filtering). When doing the DG commit you could uncheck the "Merge with Device Candidate Config" option to avoid including any changes on the local device during the config push. This will have the same issue though if changes are being made in a Panorama DG since all config in the device group will be pushed. ... View more

Please take a look at the new Panorama Administrator's Guide 5.1 which has information about using Panorama which is applicable to older versions as well. ... View more