The running configuration on Panorama comprises all the settings that you have committed and that are therefore active. The candidate configuration is a copy of the running configuration plus any inactive changes that you made since the last commit. Saving backup versions of the running or candidate configuration enables you to later restore those versions. For example, if a commit validation shows that the current candidate configuration has more errors than you want to fix, you can restore a previous candidate configuration. You can also revert to the current running configuration without saving a backup first.

After a commit on a local firewall that runs PAN-OS 5.0 or later, a backup is sent of its running configuration to Panorama. Any commits performed on the local firewall will trigger the backup, including commits that an administrator performs locally on the firewall or automatic commits that PAN-OS initiates (such as an FQDN refresh). By default, Panorama stores up to 100 backups for each firewall, though this is configurable. To store Panorama and firewall configuration backups on an external host, you can schedule exports from Panorama or export on demand. You can also import configurations from firewalls into Panorama device groups and templates to Transition a Firewall to Panorama Management.

(VMware ESXi and vCloud Air only) VMware snapshot functionality is not supported for a Panorama virtual appliance deployed on VMware ESXi and vCloud Air. Taking snapshots of a Panorama virtual appliance can impact performance, result in intermittent and inconsistent packet loss, and Panorama may become unresponsive. Additionally, you may lose access to the Panorama CLI and web interface and switching to Panorama mode is not supported. Instead, save and export your named configuration snapshot to any network location.