Commit, Validate, and Preview Firewall Configuration Changes
Table of Contents
Commit, Validate, and Preview Firewall Configuration Changes
A commit is the process of activating pending
changes to the firewall configuration. You can filter pending changes
by administrator or location and then preview, validate,
or commit only those changes. The locations can be specific virtual
systems, shared policies and objects, or shared device and network
settings.
The firewall queues commit requests so that you
can initiate a new commit while a previous commit is in progress.
The firewall performs the commits in the order they are initiated
but prioritizes auto-commits that are initiated by the firewall
(such as FQDN refreshes). However, if the queue already has the
maximum number of administrator-initiated commits, you must wait
for the firewall to finish processing a pending commit before initiating
a new one. To cancel pending commits or view details about commits
of any status, see Manage
and Monitor Administrative Tasks.
When you initiate
a commit, the firewall checks the validity of the changes before
activating them. The validation output displays conditions that
either block the commit (errors) or that are important to know (warnings).
For example, validation could indicate an invalid route destination
that you need to fix for the commit to succeed. The validation process
enables you to find and fix errors before you commit (it makes no
changes to the running configuration). This is useful if you have
a fixed commit window and want to be sure the commit will succeed without
errors.
When enabled and managed by a Panorama™ management
server, managed firewalls locally test the configuration committed
locally or pushed from Panorama to verify that the new changes do
not break the connection between Panorama and the managed firewall.
If the committed configuration breaks the connection between Panorama
and a managed firewall, then the firewall automatically fails the
commit and the configuration is reverted to the previous running
configuration. Additionally, firewalls managed by a Panorama management
server test their connection to Panorama every 60 minutes and if
a managed firewalls detects that it can no longer successfully connect
to Panorama, then it reverts its configuration to the previous running
configuration.
The commit, validate, preview, save,
and revert operations apply only to changes made after the last
commit. To restore configurations to the state they were in before
the last commit, you must load a previously backed up configuration.
To
prevent multiple administrators from making configuration changes
during concurrent sessions, see Manage
Locks for Restricting Configuration Changes.
- Configure the scope of configuration changes that you will commit, validate, or preview.
- Click Commit at the top of the web interface.Select one of the following options:
- Commit All Changes (default)—Applies the commit to all changes for which you have administrative privileges. You cannot manually filter the commit scope when you select this option. Instead, the administrator role assigned to the account you used to log in determines the commit scope.
- Commit Changes Made By—Enables you to filter the commit scope by administrator or location. The administrative role assigned to the account you used to log in determines which changes you can filter.
To commit the changes of other administrators, the account you used to log in must be assigned the Superuser role or an Admin Role profile with the Commit For Other Admins privilege enabled.(Optional) To filter the commit scope by administrator, select Commit Changes Made By, click the adjacent link, select the administrators, and click OK.(Optional) To filter by location, select Commit Changes Made By and clear any changes that you want to exclude from the Commit Scope.If dependencies between the configuration changes you included and excluded cause a validation error, perform the commit with all the changes included. For example, when you commit changes to a virtual system, you must include the changes of all administrators who added, deleted, or repositioned rules for the same rulebase in that virtual system.Preview the changes that the commit will activate.This can be useful if, for example, you don’t remember all your changes and you’re not sure you want to activate all of them.The firewall compares the configurations you selected in the Commit Scope to the running configuration. The preview window displays the configurations side-by-side and uses color coding to indicate which changes are additions (green), modifications (yellow), or deletions (red).Preview Changes and select the Lines of Context, which is the number of lines from the compared configuration files to display before and after each highlighted difference. These additional lines help you correlate the preview output to settings in the web interface. Close the preview window when you finish reviewing the changes.Because the preview results display in a new browser window, your browser must allow pop-ups. If the preview window does not open, refer to your browser documentation for the steps to allow pop-ups.Preview the individual settings for which you are committing changes.This can be useful if you want to know details about the changes, such as the types of settings and who changed them.- Click Change Summary.(Optional) Group By a column name (such as the Type of setting).Close the Change Summary dialog when you finish reviewing the changes.Validate the changes before you commit to ensure the commit will succeed.
- Validate Changes.The results display all the errors and warnings that an actual commit would display.Resolve any errors that the validation results identify.Commit your configuration changes.Commit your changes to validate and activate them.To view details about commits that are pending (which you can still cancel), in progress, completed, or failed, see Manage and Monitor Administrative Tasks.
