• Skip to primary navigation
  • Skip to main content
  • Skip to primary sidebar

Rowell Dionicio

Get Techie With It

  • Home
  • About
  • Newsletter
  • Resources
    • Archives
    • Book List
    • YouTube
  • Learn
    • Wi-Fi 6E
    • CCNP Enterprise Core
    • DevNet Associate
    • PCNSA Certified
  • Blog
  • Contact
  • Show Search
Hide Search

PAN-OS Configuration Management – PCNSA

May 30, 2022 By Rowell Leave a Comment

Configuration of a Palo Alto Networks firewall is kept in one of two configuration stores. The PCNSA requires you know how the firewall maintains configuration such as saving, reverting, and loading.

There are two configuration stores you should be aware of:

  • Candidate configuration
  • Running configuration

You can make changes to the firewall configuration using either the web GUI or CLI.

Navigate to Device > Setup > Operations > Configuration Management to view these operations.

Location of Configuration Management on PAN-OS

Candidate Configuration

Any changes to the configuration are done on the candidate configuration. It is not directly applied to the firewall until you commit the changes.

The Candidate Configuration will live in the control-plane memory. A commit will activate those changes and place them in the Running Configuration.

There is a distinction between saving and committing your configuration. Saving a configuration, in the Palo Alto Networks world, will save your changes to the Candidate Configuration. They are not active. They are not installed or implemented.

A saved Candidate Configuration is kept in persistent storage. It is a snapshot. If you were to make changes and reboot the firewall, those changes will no longer be there because it lived in memory.

Committing a change is the act of installing the changes stored in the Candidate Configuration into Running Configuration.

Running Configuration

The Running Configuration is kept on a file named running-config.xml. This file is the active configuration used by the firewall during operation. It is persistent with a reboot.

The data-plane memory is where the Running Configuration lives.

Configuration changes are activated from the Candidate Configuration during the Commit process.

It is possible to save snapshots of the Running Configuration. A different Running Configuration can be loaded to overwrite the current running-config.xml file.

Configuration Operations

There are various operations that can be performed on the Candidate Configuration and Running Configuration. They are:

  • Save
  • Load
  • Import
  • Export
  • Revert

Know the differences between each one and when it should be used.

Save

A Save operation will create a snapshot of the Candidate Configuration. There is a default snapshot file named snapshot.xml. It is possible to created a named configuration snapshot that does not overwrite this file.

One possible scenario that comes to mind is creating a backup of the configuration with a date and time or special name such as “backup-before-firewall-rule-purge-5-26-2022.xml”. Or it could be used to save the Candidate Configuration to export and import into another firewall.

Saving a Named Configuration in PAN-OS

If you’d like to save the Candidate Configuration, to the snapshot.xml file then click on Save candidate configuration.

Load

If you’re smart, you’ll backup your configurations to a file and store them safely. There might come a time where you need to load that configuration file to the firewall. Or you’re loading a template configuration to the firewall.

The Load operation comes in handy for loading a named configuration snapshot file or a configuration version.

When loading a configuration snapshot, you will select the file from the dropdown list.

Loading a Named Configuration in PAN-OS

Loading a configuration version allows you to go back into a previous configuration version.

It is useful for loading a previous configuration that worked to revert any changes you might have just committed. The dropdown will specify the date and time of the configuration snapshot.

Loading a Versioned Configuration

Export

The Export function allows you to save a configuration to a file kept off of the firewall. You can export a named configuration to an xml file and use it on another similar firewall model.

Export a Named Configuration in PAN-OS

Export Versioned Configuration is similar to the above except you’re selecting a specific version of configuration to save off of the firewall.

Import

The exact opposite of Export 🙂 In this operation you will be taking a saved configuration file and importing it into the firewall. You will be prompted to select the file from your computer. The file will be stored on the firewall but the configuration is not activated. You must load the configuration afterwards.

Revert

Hopefully, you won’t need to use this operation. You can quickly go back to the last saved configuration or running configuration.

Revert to last saved config will load the snapshot.xml file

Revert to running config restores the configuration from the running-config.xml file

Be cautious with this operation because once you click Yes it will perform the operation. One click to revert.

Revert configuration

It’s my preference to avoid using Revert and opt to use one of the other operations above.

Share this:

  • Facebook
  • LinkedIn
  • Twitter

Related

Filed Under: Certifications Tagged With: pan-os, pcnsa

About Rowell

Wi-Fi expert. Coffee addict ☕️. Tech nerd. Business owner.

Reader Interactions

Leave a Reply Cancel reply

Primary Sidebar

Recent Posts

  • 6 GHz Frame Captures with EtherScope nXG
  • Manage Cisco Catalyst in the (Meraki) Cloud
  • Q1 2022 Income Report
  • First Look at Ekahau AI Pro – Network Simulator
  • PAN-OS Configuration Management – PCNSA

Categories

  • bschool
  • Certifications
  • Coding
  • DevNet Associate
  • Events
  • Lab
  • Networking
  • Personal
  • Podcasting
  • Professional
  • Reviews
  • Security
  • Short Stories
  • Uncategorized
  • Wireless

Archives

  • June 2022
  • May 2022
  • January 2022
  • December 2021
  • November 2021
  • August 2021
  • July 2021
  • April 2021
  • February 2021
  • January 2021
  • December 2020
  • November 2020
  • October 2020
  • September 2020
  • August 2020
  • June 2020
  • May 2020
  • April 2020
  • March 2020
  • February 2020
  • January 2020
  • December 2019
  • November 2019
  • October 2019
  • August 2019
  • June 2019
  • May 2019
  • April 2019
  • March 2019
  • February 2019
  • January 2019
  • November 2018
  • September 2018
  • August 2018

Copyright © 2022 · Written by Rowell Dionicio · You're awesome.

 

Loading Comments...