How Configuration Change is Being Applied Depending on “Merge with Candidate Config” Commit Option

PAN-OS 6.0 and later

Details

When pushing "Device Group" configuration change from Panorama down to the managed Palo Alto Networks firewall, the user can select "Merge with Device Candidate Config" option, as shown below:

This option causes the Palo Alto Networks firewall to include its local candidate configuration when the commit is invoked from Panorama. So the commit process of "Device Group" configuration on the firewall (sent by Panorama) depends on "Merge with Device Candidate Config" in the following way:

• If the "Merge with Candidate Config" option is disabled, the configuration sent from Panorama is merged directly with the local running-config on the firewall, and then applied (committed), so candidate-config is left untouched.
• If the "Merge with Candidate Config" option is enabled, the configuration sent from Panorama is first merged with candidate-config and then intermediate commit is done on candidate-config. Then running-config is replaced with a new candidate-config and the final commit is done on running-config.

owner: djoksimovic