©
Palo
Alto
Networks,
Inc.
Panorama
6.1
Administrator’s
Guide
•
195
Administer
Panorama
Restrict
Access
to
Configuration
Changes
Restrict
Access
to
Configuration
Changes
Use
locks
to
prevent
multiple
administrative
users
from
making
configuration
changes
or
committing
changes
on
Panorama,
shared
policies,
or
to
selected
templates
and/or
device
groups.
Types
of
Locks
The
available
lock
types
are:
Config
Lock
—Blocks
other
administrators
from
making
changes
to
the
configuration.
This
type
of
lock
can
be
set
globally
or
for
a
virtual
system.
It
can
be
removed
only
by
the
administrator
who
set
it
or
by
a
superuser.
The
configuration
lock
is
not
released
automatically.
Commit
Lock
—Blocks
other
administrators
from
committing
changes
until
all
of
the
locks
have
been
released.
The
commit
lock
ensures
that
partial
configuration
changes
are
not
inadvertently
committed
to
the
firewall
or
to
Panorama
when
two
administrators
are
making
changes
at
the
same
time
and
the
first
administrator
finishes
and
commits
changes
before
the
second
administrator
has
finished.
The
lock
is
released
automatically
when
the
administrator
who
applied
the
lock
commits
the
changes;
the
lock
can
be
removed
manually
by
the
administrator
who
took
the
lock
or
by
the
superuser.
If
a
commit
lock
is
held
on
a
firewall,
and
an
administrator
commits
configuration
changes
or
shared
policies
to
a
template
or
device
group
that
includes
that
firewall,
the
commit
will
fail
with
an
error
message
indicating
that
there
is
an
outstanding
lock
on
a
firewall.
Locations
for
Taking
a
Lock
The
administrator
can
take
a
lock
for
any
of
the
following
categories,
or
locations
:
Device Group
—Restricts
changes
to
the
selected
device
group.
Template
—Restricts
changes
to
the
firewalls
included
in
the
selected
template.
Shared
—Restricts
changes
to
the
centrally
administered
policies—pre
‐
rules
and
post
‐
rules—that
are
shared
across
all
device
groups.
For
more
information
on
shared
policies,
see
.
Read
‐
only
administrators
who
cannot
make
configuration
changes
to
the
firewall
or
Panorama
will
not
be
able
to
take
either
lock.
Role
‐
based
administrators
who
cannot
commit
changes
can
take
the
config
lock
and
save
the
changes
to
the
candidate
configuration.
They
cannot,
however,
commit
the
changes
themselves.
Because
they
cannot
commit
the
changes,
the
lock
is
not
automatically
released
on
commit;
the
administrator
must
manually
remove
the
config
lock
after
making
the
required
changes.
