Manage and Administer the Next-Generation Firewall
Administration surface
The MGT interface is separate from the data ports and exposes HTTPS, SSH, and Panorama connectivity. Under Device > Setup you configure management access, update schedules for content and software, and configuration backups. Content releases (Applications and Threats, Antivirus, WildFire, URL database) are different from PAN-OS software upgrades; the exam likes to swap these terms.
Commit workflow
Changes remain in a candidate configuration until committed. Commit validates and activates; Commit Force bypasses validation warnings. On Panorama you must Commit locally to the Panorama configuration, then Commit and Push to device groups and templates. A common trap is editing a device group and expecting the firewall to change before the push completes. Configuration versions are stored automatically; Device > Setup > Operations lets you load an earlier version and commit to roll back. Exporting a configuration bundle or device state is the backup method.
Administration and HA
Administrators authenticate locally or through authentication profiles (RADIUS, TACACS+, LDAP, SAML, Kerberos). Roles include superuser, superuser (read-only), device admin, vsys admin and custom roles; password profiles and MFA harden accounts. High availability uses an HA1 control link and HA2 data link, active/passive or active/active peers, path and link monitoring, and session synchronisation; preemption is optional.
Worked example: an admin changes a device-group policy in Panorama and the firewall shows nothing new. The fix is Commit on Panorama, Commit and Push, then verify push status per device.
Rule of thumb: local change means commit; Panorama change means commit, then push.