Management plane: permitted IPs, service routes, candidate vs running config, commits, partial commits, config locks and named snapshots

Palo Alto firewalls separate the management plane, which runs the web interface, CLI, logging, reporting and configuration, from the data plane, which processes traffic. The separation means a busy data plane does not lock you out of management, and heavy management tasks do not slow traffic. Protecting and operating the management plane carefully is basic hygiene and a favorite exam area, because a compromised management interface means a compromised firewall.