>
    Strata Copilot
    Push Selective Configuration Changes to Managed Devices
    Focus
    Download PDF
    Focus
    1. Home
    2. Panorama
    3. Administer Panorama
    4. Push Selective Configuration Changes to Managed Devices
    Download PDF
    Panorama

    Push Selective Configuration Changes to Managed Devices

    Table of Contents

    Push Selective Configuration Changes to Managed Devices

    Selectively push configuration objects from the Panorama™ management server to your managed firewalls.
    Selective push allows Panorama administrators to select configuration changes committed by one or more administrators to push to managed firewalls. This enables a greater degree of control, facilitates collaborative management, and reduces the risk of pushing an incomplete configuration that could result in an outage. To allow a Panorama administrator to selectively push configuration changes, you must configure an admin role profile that allows selective push and assign the admin role profile to the Panorama administrator. A system log is generated for a successful selective push to managed firewalls.
    You can also leverage selective commit of configuration changes for further selectivity when pushing configuration changes to your managed firewalls. Selective commit allows you to select and commit specific configuration objects. After you commit, you can then use selective push to review and deploy all committed changes made by different administrators
    The ability to specify which Panorama administrator configuration changes to include in a push to managed firewalls allows multiple administrators to effectively manage firewall configurations without disrupting other administrators and reduces the risk of pushing an incomplete configuration to your managed firewalls that could result in an outage. Leveraging the ability to selectively push configuration changes allows you to maintain your defined operational procedure while still being able to successfully make independent configuration changes that are not defined within your operational scope.
    Selective push is supported for managed firewalls only and is supported for managed firewalls running any supported PAN-OS release. Selective push is not supported for Log Collectors, collector groups, WildFire appliances, and WildFire clusters. For Panorama in an active/passive high availability (HA) configuration, selective push is supported from the active HA peer only.
    While selective push offers flexibility, a full push to all firewalls is mandatory in the following scenarios to prevent unexpected behavior. You must perform a full push before resuming selective pushes:
    • After you onboard a new managed firewall to Panorama.
    • When you import template variables via CSV.
      If you need to override template variables for specific devices, you can change the values directly from the Panorama Managed Devices Summary page.
    • When you move security policies across device groups.
    • After renaming or moving templates, template stacks, or device groups in the hierarchy.
    • When a Panorama HA failover occurs.
    • When the configuration versions of a managed firewall are outside the config audit window.
      The config audit window specifies the number of configuration versions Panorama saves for audit and has a configurable default of 100. For details see, Compare Changes in Panorama Configurations.
    • After loading or importing a device configuration partially or fully into Panorama.
    • When you change the Master Key for managed firewalls.
    • Before and after you upgrade a managed firewall to a version that supports selective push.
    • In case of any emergency, if you need to perform a configuration change and push the changes from the passive peer of a Panorama HA pair.
    For additional details on how Selective Push works, including technical considerations and best practices, see Demystifying Selective Push on Panorama.
    1. Log in to the Panorama Web Interface.
      The Panorama administrator must be configured with an admin role profile that allows the push of configuration changes made by other admins to managed firewalls. The default Superuser or Panorama admin role privileges support full object level configuration privileges.
    2. Select Commit and Push to Devices.
      You can also select Commit and Push to commit selective configuration changes to Panorama and push already committed changes in one operation.
      You cannot selectively push a configuration change that has not been committed.
    3. Change the push scope to Push Changes Made By and filter the push scope by Panorama admin to select specific device group and template stack configuration changes to push to your managed firewalls.
      The push scope displays the name of the admin currently logged in. Click the admin name to view a list of admins with committed configuration changes that have not been pushed to managed firewalls. The push scope automatically refreshes to display an updated list of device groups and template stacks based on the admins selected.
      (PAN-OS 11.1.13 and later 11.1 releases) When you disable selective push, the options associated with selective push, such as the Push Changes Made By or Push All Changes options do not appear. By default, the system automatically performs a full push (Push All Changes). For more information, see Enable or Disable Selective Push.
    4. In the Include in Push column, check (enable) the configuration objects you want to include in the commit.
      The push scope displays only device groups and template stacks that are out of sync.
      You must select and push the entire device group or template stack configuration that was committed. Object level changes displayed in the push scope are informational and cannot be excluded from the push for the device group or template stack you select.
    5. (Optional) Edit Selections and select the managed firewalls associated with the impacted device groups and template stacks.
      Skip this step to push to all managed firewalls associated with the impacted device groups and template stacks.
      Disable the Merge with Device Candidate Config setting if you manage and commit local firewall configuration changes independently of the Panorama managed configuration.
      This setting is enabled by default and merges any pending local firewall configurations with the configuration push from Panorama. The local firewall configuration is merged and committed regardless of the admin pushing the changes from Panorama or the admin who made the local firewall configuration changes.
    6. Push the configuration changes.
    7. If your admin role allows you to push configuration changes for other Panorama administrators, review the Confirm Push to Devices prompt and Push.
      This warning is displayed when the administrators included in the Admin Scope make conflicting configuration changes to the same object. For example, Admin1 is allowed to push configuration changes to managed firewalls while Admin2 is not allowed. Admin1 creates SecurityRule, adds ZoneA as the source zone and commits the change. Admin2 then modifies SecurityRule, deletes ZoneA, adds ZoneB, and as well as making additional configuration changes. Admin2 commits the changes to Panorama. Admin1 wants to include the configuration changes made by Admin1 in the push to managed firewalls. In this scenario, Admin1 is prompted to confirm the push because the configuration changes made to SecurityRule conflict.
      If you are not confident in the configuration changes made by other Panorama administrators, Continue push with my selected changes only to only push your own configuration changes and overwrite any configuration object conflict with the changes you made.
    8. Select PanoramaManaged DevicesSummary and click the Template Last Commit State for the impacted firewalls to review the Last Push State Details.

    Enable or Disable Selective Push

    (PAN-OS 11.1.13 and later 11.1 releases)
    While a selective push (Push Changes Made by) is efficient because it only pushes configurations modified by specific administrators, some environments demand the highest level of configuration assurance, which might require a full push (Push All Changes). To enforce consistency, you can manually disable selective push to gain explicit control over configuration deployments.
    After you disable selective push, the options associated with selective push, such as the Push Changes Made By or Push All Changes do not appear. The system automatically reverts to performing a full push (Push All Changes) as the default deployment operation.
    Deployment and Control Guidelines
    • Selective push is enabled by default on Panorama. Disabling selective push removes the option for administrators to push only their specific changes, thereby ensuring a full configuration push every time.
    • Enabling selective push does not restrict your ability to manually perform a full push when necessary.
    • You can disable selective push if you have an explicit requirement to force a full configuration push for every deployment or push.
    • You can monitor and configure the selective push state using either the Panorama web interface or the command line interface (CLI).
    After you re-enable selective push, you must perform a full push to all managed devices (including all associated device groups for multi-vsys firewalls) before selective push functionality fully restores and can resume.
    Requirements for disabling selective push
    Ensure that you adhere to the following requirements when attempting to enable or disable selective push feature:
    • Commit Operations: You cannot enable or disable selective push when a local Commit is in progress, or if a Commit and Push is pending. It is a best practice to either enable or disable selective push during a maintenance windowor when no administrators are actively using Panorama.
    • High Availability (HA): If HA is configured, selective push is automatically enabled or disabled on the passive Panorama during failover. Consequently, if the passive Panorama is unreachable or not responding, you cannot enable or disable selective push on the active device.
    • Scheduled Config Push: You cannot disable selective push if there are active scheduled config push configurations. Before attempting to disable selective push, you must either disable or delete existing scheduled pushes, or modify them to perform a full push by removing all associated administrators. For more information on managing scheduled config pushes, see Configure Scheduled Config Push.

    Disable Selective Push

    (PAN-OS 11.1.13 and later 11.1 releases) Perform the following steps to disable selective push.
    1. Log in to the Panorama Web Interface.
    2. Select PanoramaSetup Management .
    3. Edit the Panorama Settings, and disable Enable Selective Push.
      Optionally, use the following CLI commands to modify or view the selective push state:
      • To disable selective push: debug selective-push disable
      • To enable selective push: debug selective-push enable
      • To verify the current state: debug selective-push show
      After you disable selective push, the options associated with selective push, such as the Push Changes Made By or Push All Changes options do not appear.

    © 2026 Palo Alto Networks, Inc. All rights reserved.