Click Commit at the top right of the web interface and select an operation for pending changes to the Panorama configuration and changes that Panorama pushes to firewalls, Log Collectors, and WildFire clusters and appliances:
You can filter pending changes by administrator or location and then commit, push, validate, or preview only those changes. The location can be specific device groups, templates, Collector Groups, Log Collectors, WildFire appliances and clusters, shared settings, or the Panorama management server.
Auto-Commit—An automatic commit, referred to as an auto-commit, is a PAN-OS function that reapplies the running configuration contained in the Panorama configuration file to Panorama on reboot. It is a background process, and the time to complete the auto-commit may vary depending on the complexity and size of the configuration. Auto-commit also acts as a form of configuration validation after a Panorama reboot as the validation process is included in every PAN-OS configuration commit.
|
|
|
|
|
|
|
|
•
|
Custom role—The privileges of the Admin Role profile assigned to your account determine the commit scope (see Panorama > Admin Roles). If the profile includes the privilege to Commit For Other Admins, Panorama commits changes configured by any and all administrators. If your Admin Role profile does not include the privilege to Commit For Other Admins, Panorama commits only your changes and not those of other administrators.
|
|
|
|
|
•
|
Superuser role—You can limit the commit scope to changes that specific administrators made and to changes in specific locations.
|
|
•
|
Custom role—The privileges of the Admin Role profile assigned to your account determine your filtering options (see Panorama > Admin Roles). If the profile includes the privilege to Commit For Other Admins, you can limit the commit scope to changes configured by specific administrators and to changes in specific locations. If your Admin Role profile does not include the privilege to Commit For Other Admins, you can limit the commit scope only to the changes you made in specific locations.
|
|
•
|
Filter by administrator—Even if your role allows committing the changes of other administrators, the commit scope includes only your changes by default. To add other administrators to the commit scope, click the <usernames> link, select the administrators, and click OK.
|
|
|
|
|
•
|
<device-group>—The name of the device group in which the policy rules or objects are defined.
|
|
•
|
<template>—The name of the template or template stack in which the settings are defined.
|
|
•
|
<log-collector>—The name of the Log Collector in which the settings are defined.
|
|
|
|
|
•
|
Panorama—Settings that are specific to the Panorama management server configuration.
|
|
•
|
Device Group—Settings that are defined in a specific device group.
|
|
•
|
Template—Settings that are defined in a specific template or template stack.
|
|
•
|
Log Collector—Settings that are specific to a Log Collector configuration.
|
|
•
|
Other Changes—Settings that are not specific to any of the preceding configuration areas (such as shared objects).
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
•
|
Object Name—The name that identifies the policy, object, network setting, or device setting.
|
|
•
|
Type—The type of setting (such as Address, Security rule, or Zone).
|
|
•
|
Location Type—Indicates whether the setting is defined in Device Groups, Templates, Collector Groups, WildFire Appliances, or Wildfire Appliance Clusters.
|
|
•
|
Location—The name of the device group, template, Collector Group, WildFire cluster, or WildFire appliance where the setting is defined. The column displays Shared for settings that are not defined in these locations.
|
|
•
|
Operations—Indicates every operation (create, edit, or delete) performed on the setting since the last commit.
|
|
•
|
Owner—The administrator who made the last change to the setting.
|
|
•
|
Previous Owners—Administrators who made changes to the setting before the last change.
|
|
|
|
|
|
|
|
|
|
•
|
Custom role—The privileges of the Admin Role profile assigned to your account determine the push scope (see Panorama > Admin Roles). If the profile includes the privilege to Commit For Other Admins, Panorama pushes changes configured by any and all administrators. If your Admin Role profile does not include the privilege to Push For Other Admins, Panorama pushes only your changes and not those of other administrators.
|
|
|
|
|
•
|
Superuser role—You can limit the push scope to changes that specific administrators made and to changes in specific locations.
|
|
•
|
Custom role—The privileges of the Admin Role profile assigned to your account determine your filtering options (see Panorama > Admin Roles). If the profile includes the privilege to Push For Other Admins, you can limit the push scope to changes configured by specific administrators and to changes in specific locations. If your Admin Role profile does not include the privilege to Push For Other Admins, you can limit the push scope only to the changes you made in specific locations.
|
|
•
|
Filter by administrator—Even if your role allows pushing the changes of other administrators, the push scope includes only your changes by default. To add other administrators to the push scope, click the <usernames> link, select the administrators, and click OK.
|
|
|
|
|
•
|
Commit > Commit and Push—The scope includes all locations with changes that require a Panorama commit.
|
|
•
|
Access domains—If you implemented access domains, Panorama automatically filters the Push Scope based on those domains (see Panorama > Access Domains). Regardless of your administrative role and your filtering choices, the scope includes the configuration changes only in access domains assigned to your account.
|
|
|
|
|
•
|
Templates—Settings defined in a specific template or template stack.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Edit Selections and select Device Groups or Templates to display the options in the following rows.
|
|
|
|
|
|
|
|
|
|
|
|
|
•
|
Active—Normal traffic-handling operational state.
|
|
•
|
Initiating—The firewall is in this state for up to 60 seconds after bootup.
|
|
•
|
Suspended—An administrator disabled the firewall.
|
|
•
|
Tentative—For a link or path monitoring event in an active/active configuration.
|
|
|
|
|
|
|
Preview Changes to compare the configurations you selected in the Push Scope to the Panorama running configuration. Panorama filters the output to show results only for the firewalls and virtual systems you selected in the Device Groups or Templates tab. The preview window uses color coding to indicate which changes are additions (green), modifications (yellow), or deletions (red).
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
If you push a configuration with Force Template Values enabled, all overridden values on the firewall are replaced with values from the template. Before you use this option, check for overridden values on the firewalls to ensure your commit does not result in any unexpected network outages or issues caused by replacing those overridden values.
|
|
|
Edit Selections and select Log Collector Groups to include in the push operation. This tab displays the following options:
|
•
|
Select All—Selects every Collector Group in the list.
|
|
|
|
Edit Selections and select WildFire Appliances and Clusters to display the following options.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
) to clear the commit queue or see details about commits. For more information on configuration changes, commit processes, commit validations, and the commit queue, refer to Panorama Commit and Validation Operations. You can also Save Candidate Configurations, Revert Changes, and import, export, or load configurations (Device > Setup > Operations).