Panorama Commit Operations
Table of Contents
Panorama Commit Operations
Activate pending configuration changes made on the Panorama™ management server and
push them to your managed firewalls, Log Collectors, and WildFire clusters and
appliances.
Click Commit at the top right
of the web interface and select an operation for pending changes
to the Panorama configuration and changes that Panorama pushes to
firewalls, Log Collectors, and WildFire clusters and appliances:
- —Activates changes you made in the configuration of the Panorama management server. This action also commits device group, template, Collector Group, and WildFire cluster and appliance changes to the Panorama configuration without pushing the changes to firewalls, Log Collectors, or WildFire clusters and appliances. Committing just to the Panorama configuration enables you to save changes that are not ready for activation on the firewalls, Log Collectors, or WildFire clusters and appliances.When pushing configurations to managed devices, Panorama 8.0 and later releases push the running configuration, which is the configuration that is committed to Panorama. Panorama 7.1 and earlier releases push the candidate configuration, which includes uncommitted changes. Therefore, Panorama 8.0 and later releases do not let you push changes to managed devices until you first commit the changes to Panorama.
- —Pushes the Panorama running configuration to device groups, templates, Collector Groups, and WildFire clusters and appliances.
- —Commits all configuration changes to the local Panorama configuration and then pushes the Panorama running configuration to device groups, templates, Collector Groups, and WildFire clusters and appliances.
You can filter pending changes by administrator or location and
then commit, push, validate, or preview only those changes. The
location can be specific device groups, templates, Collector Groups,
Log Collectors, WildFire appliances and clusters, shared settings,
or the Panorama management server.
Auto-Commit—An automatic commit, referred to as an auto-commit, is a PAN-OS
function that reapplies the running configuration contained in the Panorama
configuration file to Panorama on reboot. It is a background process, and the time to
complete the auto-commit may vary depending on the complexity and size of the
configuration. Auto-commit also acts as a form of configuration validation after a
Panorama reboot as the validation process is included in every PAN-OS configuration
commit.
When you commit changes, they become part of the running configuration.
Changes that you haven’t committed are part of the candidate configuration.
Panorama queues commit requests so that you can initiate a new commit
while a previous commit is in progress. Panorama performs the commits
in the order they are initiated but prioritizes auto-commits that
are initiated by Panorama (such as FQDN refreshes). However, if
the queue already has the maximum number of administrator-initiated
commits, you must wait for Panorama to finish processing a pending commit
before initiating a new one. You can use the Task
Manager (
![]()
) to
clear the commit queue or see details about commits. For more information
on configuration changes, commit processes, commit validations,
and the commit queue, refer to Panorama Commit and Validation Operations.
You can also Save
Candidate Configurations, Revert
Changes, and import, export, or load configurations (Device
> Setup > Operations).
The following options are available for committing, validating,
or previewing configuration changes.
Field/Button | Description |
|---|---|
The following options apply
when you commit to Panorama by selecting or . | |
Commit All Changes | Commits all changes for which you have administrative
privileges (default). You cannot manually filter the scope of the configuration
changes that Panorama commits when you select this option. Instead,
the administrator role assigned to the account you used to log in
determines the commit scope:
If
you have implemented access domains, Panorama automatically applies
those domains to filter the commit scope (see Panorama
> Access Domains). Regardless of your administrative role,
Panorama commits only the configuration changes in the access domains
assigned to your account. |
Commit
Changes Made By | Filters the scope of the configuration changes
Panorama commits. The administrative role assigned to the account
you used to log in determines your filtering options:
Filter
the commit scope as follows:
If you have implemented access
domains, Panorama automatically filters the commit scope based on
those domains (see Panorama
> Access Domains). Regardless of your administrative role
and your filtering choices, the commit scope includes only the configuration
changes in the access domains assigned to your account. After
you load a configuration (Device
> Setup > Operations), you must Commit All Changes. When
you commit changes to a device group, you must include the changes
of all administrators who added, deleted, or repositioned rules
for the same rulebase in that device group. |
Commit Scope | Lists the locations that have changes to
commit. Whether the list includes all changes or a subset of the
changes depends on several factors, as described for Commit
All Changes and Commit Changes Made By.
The locations can be any of the following:
|
Location Type | This column categorizes the locations of
pending changes:
|
Object Type | Displays the object type of the configuration
change. For example, if you configured any network profile
(), profiles is
displayed. If you configure an address group (), address-group is displayed. |
Admins | Name of the administrator that made the
configuration change. |
Include in Commit (Partial
commit only) | Enables you to select the changes you want
to commit. By default, all changes within the Commit
Scope are selected. This column displays only after
you choose to Commit Changes Made By specific
administrators. There might be dependencies
that affect the changes you include in a commit. For example, if
you add an object and another administrator then edits that object,
you cannot commit the change for the other administrator without
also committing your own change. |
Group by Type | Groups the list of configuration changes
in the Commit Scope by Location
Type. |
Preview Changes | Enables you to compare the configurations
you selected in the Commit Scope to the running
configuration. The preview window uses color coding to indicate
which changes are additions (green), modifications (yellow), or
deletions (red). To help you match the changes to sections
of the web interface, you can configure the preview window to display Lines
of Context before and after each change. These lines
are from the files of the candidate and running configurations that
you are comparing. Because the preview results display
in a new browser window, your browser must allow pop-ups. If the
preview window does not open, refer to your browser documentation
for the steps to allow pop-ups. |
Change Summary | Lists the individual settings for which
you are committing changes. The Change Summary list
displays the following information for each setting:
Optionally,
you can Group By column name (such as Type). |
Validate Commit | Validates whether the Panorama configuration
has correct syntax and is semantically complete. The output includes
the same errors and warnings that a commit would display, including
rule shadowing and application dependency warnings. The validation process
enables you to find and fix errors before you commit (it makes no
changes to the running configuration). This is useful if you have
a fixed commit window and want to be sure the commit will succeed
without errors. |
The following options apply
when you push configuration changes to managed devices by selecting or . | |
Push All Changes | Push all changes for which you have administrative
privileges (default). You cannot manually filter the scope of the configuration
changes that Panorama pushes when you select this option. Instead,
the administrator role assigned to the account you used to log in
determines the push scope:
If
you have implemented access domains, Panorama automatically applies
those domains to filter the push scope (see Panorama
> Access Domains). Regardless of your administrative role,
Panorama pushes only the configuration changes in the access domains
assigned to your account. |
Push Changes Made By | Filters
the scope of the configuration changes Panorama pushes. The administrative
role assigned to the account you used to log in determines your
filtering options:
Filter
the push scope as follows:
If
you have implemented access domains, Panorama automatically filters
the push scope based on those domains (see Panorama
> Access Domains). Regardless of your administrative role
and your filtering choices, the push scope includes only the configuration
changes in the access domains assigned to your account. |
Push Scope | Lists the locations that have changes to
push. The locations that the scope includes by default depend on
which of the following options you select:
For
both selections, Panorama filters the Push Scope by:
You
can Edit
Selections for the Push Scope instead
of accepting the default locations. You can schedule a configuration
push when you select . |
Location Type | This column categorizes the locations of
pending changes:
|
Object Type | Displays the object type of the configuration
change. For example, if you configured any network profile
(), profiles is
displayed. If you configured an address group (), address-group is displayed. |
Entities | For each device group or template, this
column lists the firewalls (by device name or serial number) or
virtual systems (by name) included in the push operation. Edit
Selections to change the list of impacted firewalls
or virtual systems to push the configuration changes to. If
you push changes to a Collector Group, the operation includes all
the Log Collectors that are members of the group, even though they
are not listed. |
Admins | Name of the administrator that made the
configuration change. |
Include
in Push | Enables you to select the changes you want
to push. By default, all changes within the Push Scope are
selected. This column displays only after you choose to Push
Changes Made By specific administrators. |
Edit Selections | Click to select the entities to include
in the push operation: Panorama won’t
let you push changes that you did not yet commit to the Panorama
configuration. |
Device
Groups and Templates | Edit Selections and
select Device Groups or Templates to display
the options in the following rows. |
Filters | Filter the list of templates, template stacks,
or device groups and the associated firewalls and virtual systems. You
can also filter managed firewalls according to their commit state,
device state, tags, and high availability (HA) status. |
Name | Select the templates, template stacks, device
groups, firewalls, or virtual systems to include in the push operation. |
Last Commit State | Indicates whether the firewall and virtual
system configurations are synchronized with the template or device
group configurations in Panorama. |
HA Status | Indicates the high availability (HA) state
of the listed firewalls:
|
Changes Pending (Panorama) Commit | Indicates whether a Panorama commit is (yes)
or is not (no) required before you
push changes to the selected firewalls and virtual systems. |
Preview Changes column | Preview Changes to
compare the configurations you selected in the Push Scope to
the Panorama running configuration. Panorama filters the output
to show results only for the firewalls and virtual systems you selected
in the Device Groups or Templates tab.
The preview window uses color coding to indicate which changes are
additions (green), modifications (yellow), or deletions (red). Because
the preview results display in a new browser window, your browser
must allow pop-ups. If the preview window does not open, refer to
your browser documentation for the steps to allow pop-ups. |
Select All | Selects all entries in the list. |
Deselect All | Deselects all entries in the list. |
Expand All | Displays the firewalls and virtual systems
assigned to templates, template stacks, or device groups. |
Collapse All | Displays only the templates, template stacks,
or device groups, not the firewalls or virtual systems assigned
to them. |
Group HA Peers | Groups firewalls that are peers in a high
availability (HA) configuration. The resulting list displays the
active firewall (or active-primary firewall in an active/active
configuration) first and the passive firewall (or active-secondary
firewall in an active/active configuration) in parentheses. This
enables you to easily identify firewalls that are in HA mode. When
pushing shared policies, you can push to the grouped pair instead
of individual peers. For HA peers
in an active/passive configuration, consider adding both firewalls
or their virtual systems to the same device group, template, or
template stack so that you can push the configuration to both peers
simultaneously. |
Validate | Click to validate the configurations you
are pushing to the selected firewalls and virtual systems. The Task
Manager automatically opens to display the validation status. |
Filter Selected | If you want the list to display only specific
firewalls or virtual systems, select them and then select Filter
Selected. |
Merge with Candidate Config | (Selected by default) Merges the configuration
changes pushed from Panorama with any pending configuration changes
that administrators implemented locally on the target firewall.
The push operation triggers PAN-OS® to commit the merged changes.
If you clear this selection, the commit excludes the candidate configuration
on the firewall. Clear this selection
if you allow firewall administrators to commit changes locally on
a firewall and you don’t want to include those local changes when
committing changes from Panorama. Another best practice
is to perform a configuration audit on the firewall to review any
local changes before pushing changes from Panorama (see Device
> Config Audit). |
Include Device and Network Templates (Device
Groups tab only) | (Selected by default) Pushes both the device
group changes and the associated template changes to the selected
firewalls and virtual systems in a single operation. To push these
changes as separate operations, clear this option. |
Force Template Values | Overrides all local settings with objects
defined in the templates or template stacks. This includes locally
configured objects as well as objects pushed from Panorama that
were locally overwritten. If an object is locally configured on
the firewall, but is not configured in a template or template stack,
then it remains unchanged on the firewall and is not deleted. The
setting is disabled by default and must be enabled (checked) on
each push from Panorama to managed firewalls. If
you push a configuration with Force Template Values enabled,
all overridden values on the firewall are replaced with values from
the template. Before you use this option, check for overridden values
on the firewalls to ensure your commit does not result in any unexpected
network outages or issues caused by replacing those overridden values. |
Log
Collector Groups | Edit Selections and
select Log Collector Groups to include in the
push operation. This tab displays the following options:
|
WildFire
Appliances and Clusters | Edit Selections and
select WildFire Appliances and Clusters to
display the following options. |
Filters | Filter the list of WildFire appliances and
clusters. |
Name | Select the WildFire appliances and clusters
to which Panorama will push changes. |
Last Commit State | Indicates whether the WildFire appliance
and cluster configurations are synchronized with Panorama. |
No Default Selections | Enable (check) to remove the devices selected
by default to manually select specific devices to push to. The default
devices Panorama pushes to are based on the impacted device group
and template configuration changes. Enabling this setting
is persistent across pushes to devices ( and )
and is specific to the administrator account that enabled the setting.
After you enable this setting for one push, this setting is enabled
for all subsequent pushes until disabled. |
Validate Device Group Push | Validates the configurations you are pushing
to the device groups in the Push Scope list. The Task Manager automatically
opens to display the validation status. |
Validate Template Push | Validates the configurations you are pushing
to the templates in the Push Scope list. The Task Manager automatically
opens to display the validation status. |
Group by Location Type | Select to use Location Type to
group the Push Scope list. |
The following options apply
when you commit the Panorama configuration or push changes to devices. | |
Description | Enter a description (up to 512 characters)
to help other administrators understand what changes you made. The
System log for a commit event will truncate descriptions longer
than 512 characters. |
Commit / Push / Commit and Push | Starts the commit or, if other commits are
pending, adds the commit request to the commit queue. |