>
    Commit, Validate, and Preview Firewall Configuration Changes
    Focus
    Download PDF
    Focus
    1. Home
    2. PAN-OS
    3. Firewall Administration
    4. Use the Web Interface
    5. Commit, Validate, and Preview Firewall Configuration Changes
    Download PDF

    Commit, Validate, and Preview Firewall Configuration Changes

    Table of Contents
    End-of-Life (EoL)

    Commit, Validate, and Preview Firewall Configuration Changes

    A commit is the process of activating pending changes to the firewall configuration. You can filter pending changes by administrator or location and then preview, validate, or commit only those changes. The locations can be specific virtual systems, shared policies and objects, or shared device and network settings.
    The firewall queues commit requests so that you can initiate a new commit while a previous commit is in progress. The firewall performs the commits in the order they are initiated but prioritizes auto-commits that are initiated by the firewall (such as FQDN refreshes). However, if the queue already has the maximum number of administrator-initiated commits, you must wait for the firewall to finish processing a pending commit before initiating a new one. To cancel pending commits or view details about commits of any status, see Manage and Monitor Administrative Tasks.
    When you initiate a commit, the firewall checks the validity of the changes before activating them. The validation output displays conditions that either block the commit (errors) or that are important to know (warnings). For example, validation could indicate an invalid route destination that you need to fix for the commit to succeed. The validation process enables you to find and fix errors before you commit (it makes no changes to the running configuration). This is useful if you have a fixed commit window and want to be sure the commit will succeed without errors.
    When enabled and managed by a Panorama™ management server, managed firewalls locally test the configuration committed locally or pushed from Panorama to verify that the new changes do not break the connection between Panorama and the managed firewall. If the committed configuration breaks the connection between Panorama and a managed firewall, then the firewall automatically fails the commit and the configuration is reverted to the previous running configuration. Additionally, firewalls managed by a Panorama management server test their connection to Panorama every 60 minutes and if a managed firewalls detects that it can no longer successfully connect to Panorama, then it reverts its configuration to the previous running configuration.
    The commit, validate, preview, save, and revert operations apply only to changes made after the last commit. To restore configurations to the state they were in before the last commit, you must load a previously backed up configuration.
    To prevent multiple administrators from making configuration changes during concurrent sessions, see Manage Locks for Restricting Configuration Changes.
    1. Configure the scope of configuration changes that you will commit, validate, or preview.
      1. Click Commit at the top of the web interface.
      2. Select one of the following options:
        • Commit All Changes (default)—Applies the commit to all changes for which you have administrative privileges. You cannot manually filter the commit scope when you select this option. Instead, the administrator role assigned to the account you used to log in determines the commit scope.
        • Commit Changes Made By—Enables you to filter the commit scope by administrator or location. The administrative role assigned to the account you used to log in determines which changes you can filter.
        To commit the changes of other administrators, the account you used to log in must be assigned the Superuser role or an Admin Role profile with the Commit For Other Admins privilege enabled.
      3. (Optional) To filter the commit scope by administrator, select Commit Changes Made By, click the adjacent link, select the administrators, and click OK.
      4. (Optional) To filter by location, select Commit Changes Made By and clear any changes that you want to exclude from the Commit Scope.
        If dependencies between the configuration changes you included and excluded cause a validation error, perform the commit with all the changes included. For example, when you commit changes to a virtual system, you must include the changes of all administrators who added, deleted, or repositioned rules for the same rulebase in that virtual system.
    2. Preview the changes that the commit will activate.
      This can be useful if, for example, you don’t remember all your changes and you’re not sure you want to activate all of them.
      The firewall compares the configurations you selected in the Commit Scope to the running configuration. The preview window displays the configurations side-by-side and uses color coding to indicate which changes are additions (green), modifications (yellow), or deletions (red).
      Preview Changes and select the Lines of Context, which is the number of lines from the compared configuration files to display before and after each highlighted difference. These additional lines help you correlate the preview output to settings in the web interface. Close the preview window when you finish reviewing the changes.
      Because the preview results display in a new browser window, your browser must allow pop-ups. If the preview window does not open, refer to your browser documentation for the steps to allow pop-ups.
    3. Preview the individual settings for which you are committing changes.
      This can be useful if you want to know details about the changes, such as the types of settings and who changed them.
      1. Click Change Summary.
      2. (Optional) Group By a column name (such as the Type of setting).
      3. Close the Change Summary dialog when you finish reviewing the changes.
    4. Validate the changes before you commit to ensure the commit will succeed.
      1. Validate Changes.
        The results display all the errors and warnings that an actual commit would display.
      2. Resolve any errors that the validation results identify.
    5. Commit your configuration changes.
      Commit your changes to validate and activate them.
      To view details about commits that are pending (which you can still cancel), in progress, completed, or failed, see Manage and Monitor Administrative Tasks.

    © 2024 Palo Alto Networks, Inc. All rights reserved.