Palo Alto Networks Certified Network Security Engineer (PCNSE)TroubleshootMedium
A network security administrator is troubleshooting a Panorama deployment. When attempting to push configuration from Panorama to a managed firewall, the push fails with an error indicating a 'commit lock' on the firewall. What is the MOST appropriate initial action to resolve this issue?
- ADelete and re-add the managed firewall to Panorama.
- BVerify network connectivity between Panorama and the managed firewall.
- CLog in directly to the managed firewall and check for an active commit operation.
- DReboot the managed firewall to clear any hung processes.
Show answer & explanationAnswer & explanation
Correct answer: C. Log in directly to the managed firewall and check for an active commit operation.
A 'commit lock' error means another commit operation is already in progress or has hung on the managed firewall. The most appropriate initial action is to log directly into the firewall to determine the status of the commit process, which can then be addressed (e.g., waiting for it to finish, killing a hung process).
Why the other options are wrong
- A. Deleting and re-adding the firewall is an extreme measure for configuration synchronization issues, not a 'commit lock' which is about a process on the firewall.
- B. If there was a network connectivity issue, the error would likely be 'firewall unreachable' or similar, not a 'commit lock' which implies Panorama successfully communicated enough to know about the lock.
- D. Rebooting is a drastic step that should only be considered after less intrusive troubleshooting, as it causes downtime and might not solve the underlying issue if the commit is just taking a long time.
Panorama Commit Lock
A 'commit lock' indicates that a configuration commit operation is already active or hung on a managed firewall, preventing Panorama from pushing new configurations.
- Only one commit can run at a time on a firewall.
- Can be caused by a long-running commit or a hung process.
- Requires direct investigation on the firewall.
Memory trick: The firewall is busy with its own thoughts; check what it's doing inside!