Do not change the configuration locally

Question

Hi there 
 I have a few basic questions and how this feature is planned. 
 
 I have added the firewalls to a new group. Now the following message appears: 
 > The firewall is managed through Sophos Central. Do not change the configuration locally. It may result in a conflict. 
 
 Is it the idea that once the firewall has been added to a group, it can only be managed via Central?

We recently installed a firewall with SFOS v18. Background: The customer has a lot of firewalls (50+) and also a lot of objects. 
 We asked ourselves the following question. - If we now create objects on the firewall, can we import them later on Central? - If we start with Central right away, wouldn't we have to duplicate the work for later firewalls? - If we later add the firewall to a group and distribute objects, are there duplicate objects or can't we overwrite them? 
 How exactly does this new feature work with existing firewalls and their configuration and objects (e.g. host, networks, services)? 
 
 thanks 
 Bot

AlanT · Accepted Answer

The wording of the message will be toned down a bit, but it's intent is to warn admins that there are risks to changing config locally, that was originally pushed from Central. once configuration has been pushed from Central, Central can't yet verify that the config it expects to be there, is still present at a later time. If you push an object from Central, then later change it locally, then later still, update config from Central that uses that changed object, what do you expect the end result to be? Today, one of two things will happen. 1) the local object will be overwritten with the values from central, or 2) in some edge cases, the config will fail to update fully, and the device will show a sync error, till the discrepancy is resolved, or the error is skipped. 
 
 In future, objects pushed from Central will be locked, so they can't be overridden locally, but until then, making changes locally should be done with some caution.