Panorama Commit, Validation, and Preview Operations
When you are ready to activate changes that you made
to the candidate configuration on Panorama or to push changes to
the devices that Panorama manages (firewalls, Log Collectors, and
WildFire appliances and appliance clusters), you can Preview, Validate, or Commit Configuration Changes. For example, if you add a Log Collector to the Panorama configuration,
firewalls cannot send logs to that Log Collector until you commit
the change to Panorama and then push the change to the Collector
Group that contains the Log Collector.
You can filter changes by administrator or location and
then commit, push, validate, or preview only those changes. The
location can be specific device groups, templates, Collector Groups,
Log Collectors, shared settings, or the Panorama management server.
When you commit changes, they become part of the running configuration.
Changes that you haven’t committed are part of the candidate configuration.
Panorama queues commit requests so that you can initiate a new commit
while a previous commit is in progress. Panorama performs the commits
in the order they are initiated but prioritizes auto-commits that
are initiated by Panorama (such as FQDN refreshes). However, if
the queue already has the maximum number of administrator-initiated
commits (10), you must wait for Panorama to finish processing a
pending commit before initiating a new one. You can Use the Panorama Task Manager (
) to cancel pending commits or to see
details about commits that are pending, in progress, completed,
or failed. To check which changes a commit will activate, you can
run a commit preview.
When you initiate a commit, Panorama checks the validity of the
changes before activating them. The validation output displays conditions
that block the commit (errors) or that are important to know (warnings).
For example, validation could indicate an invalid route destination
that you need to fix for the commit to succeed. The validation process
enables you to find and fix errors before you commit (it makes no
changes to the running configuration). This is useful if you have
a fixed commit window and want to be sure the commit will succeed
When pushing configurations to managed devices, Panorama
pushes the running configuration. Because of this, Panorama does
not let you push changes to managed devices until you first commit
the changes to Panorama.