By default, Merge the Device Candidate Config setting is enabled when you push a configuration from the Panorama management to a managed firewall. This setting commits any pending local configuration changes on the firewall alongside the configuration pushed from Panorama. In the event local configuration changes are made, the push may fail if a local candidate configuration made on the firewall is incomplete or invalid and this setting is enabled.

If you commonly make local configuration changes on your managed firewalls, you can disable this setting to prevent any local configuration changes from being committed alongside the configuration pushed from Panorama.