Comprehensive and Detailed 150 to 250 words of Explanation From Palo Alto Networks Network Security Analyst Knowledge:
In the Palo Alto Networks management workflow-whether using a local firewall, Panorama, or Strata Cloud Manager (SCM)-there is a fundamental distinction between the Candidate Configuration and the Running Configuration. When an analyst uses the Policy Optimizer to identify applications and "clones" or creates new App-ID based rules, these changes are initially written only to the Candidate Config.
The reason the traffic does not hit the new rules immediately is that the firewall's data plane is still operating based on the last successful Running Configuration. In the context of SCM or Panorama, even after
"accepting" the rules in the interface, the changes remain in a staged state. To move these changes from the management plane to the active inspection engine, the analyst must Perform a commit.
A commit validates the configuration syntax and compiles the new policy into the hardware's lookup tables.
Without a commit, the new rules effectively do not exist in the eyes of the traffic processing engine. While
"Execute a push configuration" (Option A) is a valid step in a Panorama-to-Firewall workflow, the term Commit is the universal required action to activate local candidate changes. Furthermore, even if the rules are created, the firewall evaluates rules from top to bottom; however, the most common reason for new rules appearing "invisible" to traffic immediately after creation in the GUI is the lack of a finalized commit.