Push Selective Configuration Changes to Managed Devices
Table of Contents
Push Selective Configuration Changes to Managed Devices
Selectively push configuration objects from the Panorama™
management server to your managed firewalls.
You can include the configuration changes
committed by one or more Panorama administrators to push to your
managed firewalls. This allows for a greater degree of control when
making configuration changes and reduces the risk of pushing an incomplete
configuration to your managed firewalls. To allow a Panorama administrator
to selectively push configuration changes, you must configure an
admin role profile that allows selective push and assign the admin
role profile to the Panorama administrator. A system log is generated
for a successful selective push to managed firewalls.
You can also
leverage selective commit of
configuration changes for further selectivity when pushing
configuration changes to your managed firewalls. Selective commit
allows you to select and commit specific configuration objects.
After you commit, you can leverage selective push to review and
push all committed configuration changes made by other Panorama
administrators.
The ability specify which Panorama
administrator configuration changes to include in a push to managed
firewalls allows multiple administrators to effectively manage firewall
configurations without disrupting other administrators and reduces
the risk of pushing an incomplete configuration to your managed
firewalls that could result in an outage. Leveraging the ability
to selectively push configuration changes allows you to maintain
your defined operational procedure while still being able to successfully
make independent configuration changes that are not defined within
your operational scope.
Selective push is supported for managed
firewalls only and is supported for managed firewalls running any supported PAN-OS release.
Selective push is not supported for Log Collectors, collector groups,
WildFire appliances, and WildFire clusters. For Panorama in an active/passive
high availability (HA) configuration, selective push is supported
from the active HA peer only.
- The Panorama administrator must be configured with an admin role profile that allows the push of configuration changes made by other admins to managed firewalls. The default Superuser or Panorama admin role privileges support full object level configuration privileges.
- SelectCommitandPush to Devices.You can also selectCommit and Pushto commit selective configuration changes to Panorama and push already committed changes in one operation.You cannot selectively push a configuration change that has not been committed.
- Change the push scope toPush Changes Made Byand filter the push scope by Panorama admin to select specific device group and template stack configuration changes to push to your managed firewalls.The push scope displays the name of the admin currently logged in. Click the admin name to view a list of admins with committed configuration changes that have not been pushed to managed firewalls. The push scope automatically refreshes to display an updated list of device groups and template stacks based on the admins selected.
- In the Include in Push column, check (enable) the configuration objects you want to include in the commit.The push scope displays only device groups and template stacks that areout of sync.You must select and push the entire device group or template stack configuration that was committed. Object level changes displayed in the push scope are informational and cannot be excluded from the push for the device group or template stack you select.
- (Optional)Edit Selectionsand select the managed firewalls associated with the impacted device groups and template stacks.Skip this step to push to all managed firewalls associated with the impacted device groups and template stacks.Disable theMerge with Device Candidate Configsetting if you manage and commit local firewall configuration changes independently of the Panorama managed configuration.This setting is enabled by default and merges any pending local firewall configurations with the configuration push from Panorama. The local firewall configuration is merged and committed regardless of the admin pushing the changes from Panorama or the admin who made the local firewall configuration changes.
- Pushthe configuration changes.
- If your admin role allows you to push configuration changes for other Panorama administrators, review the Confirm Push to Devices prompt andPush.This warning is displayed when the administrators included in the Admin Scope make conflicting configuration changes to the same object. For example, Admin1 is allowed to push configuration changes to managed firewalls while Admin2 is not allowed. Admin1 createsSecurityRule, addsZoneAas the source zone and commits the change. Admin2 then modifiesSecurityRule, deletesZoneA, addsZoneB, and as well as making additional configuration changes. Admin2 commits the changes to Panorama. Admin1 wants to include the configuration changes made by Admin1 in the push to managed firewalls. In this scenario, Admin1 is prompted to confirm the push because the configuration changes made toSecurityRuleconflict.If you are not confident in the configuration changes made by other Panorama administrators,Continue push with my selected changes onlyto only push your own configuration changes and overwrite any configuration object conflict with the changes you made.
- Select and click the Template Last Commit State for the impacted firewalls to review the Last Push State Details.