Provisioning Panorama by User and Configuration Type

Overview

When Designer performs a commit for Panorama devices, either through Commit Now or as part of a Change Window, TOS performs a two-phase operation in Panorama:

Commit in Panorama: Commits the pending candidate configuration on Panorama.
Push to firewalls: Pushes the committed configuration from Panorama to the managed firewalls.

You can customize the default behavior for commit and push operations using independent settings in the stconf file.

Commit scope by user

Define which changes TOS commits to Panorama:

Only changes made by the TOS user
All pending changes made by any user (the default)

See Configure commit scope by user.

Push scope by user

Define which committed changes TOS pushes to managed firewalls:

Only changes made by the TOS user
All committed changes, regardless of the user who made the change (the default)

See Configure push scope by user.

Push scope by configuration type

This setting applies only to the push to firewall operation, and is independent of the commit scope setting.

Define which types of Panorama configuration are included in the push-to-firewalls operation:

Push only device-group configuration.
Push both device-group configuration and template configuration (the default)

See Configure push scope by configuration type.

Configure commit scope by user

Configure which user's changes are pushed to Panorama: Only TOS user changes (TufinChanges) or changes from all users (AllChanges).

Navigate to: https://<SecureTrack_IP>/securetrack/admin/stcgitest.htm
Go to Edit StConf and select Fetch StConf.
Locate the <Commit_to_panorama> flag.
To configure TOS to commit only changes made by the TOS user, set the value to TufinChanges:
```
<Commit_to_panorama>TufinChanges</Commit_to_panorama>
```
If the flag is either missing or left empty in stconf, TOS defaults to AllChanges.
Click Submit New Conf.

Configure push scope by user

Configure which committed changes are pushed to firewalls: Only those made by the TOS user (TufinChanges) or changes from all users (AllChanges).

Navigate to: https://<SecureTrack_IP>/securetrack/admin/stcgitest.htm
Go to Edit StConf and select Fetch StConf.
Locate the <Push_to_panorama> flag.
To configure TOS to push to firewalls only changes made by the TOS user, set the value to TufinChanges.
```
<Push_to_panorama_FWs>TufinChanges</Push_to_panorama_FWs>
```

If the flag is either missing or left empty in stconf, TOS defaults to AllChanges.

Click Submit New Conf.

Configure push scope by configuration type

Configure which committed configuration changes are pushed to firewalls: only device-group configuration (false or no) or both device group and and template configuration fchanges from all users (true or yes).

Navigate to: https://<SecureTrack_IP>/securetrack/admin/stcgitest.htm
Go to Edit StConf and select Fetch StConf.
In the stconf file, locate the <Commit_include_template> flag.
To push only device-group configuration, set the value to either false or no.
```
<Commit_include_template>false</Commit_include_template>
```
If the flag is either missing or empty in stconf, TOS defaults to true or yes, meaning that the push to managed firewalls also includes the template configuration.
Click Submit New Conf.