topic Re: Issue with PA-1410 platform disk size in General Topics

Issue with PA-1410 platform disk size

MRamadanAHafiez — Mon, 30 Sep 2024 11:12:05 GMT

Hello Team,

Recently we have deployed PA-1410 in our datacenter and since first day we are having issue with disk space in loggin.

and after contacting the support, logging is not more than a week which is not accepted from our side.

I know that the PA-1410 disk is 128GB.

Did any one met with a similar issue? what was the solution ? is it available for paloalto to replace the HDD with anothe one with more space?

TIA

Re: Issue with PA-1410 platform disk size

Spiff_21 — Mon, 30 Sep 2024 19:26:14 GMT

Yes me to. I have less than a day. They really skimmed on the disk. which is BAAAD.

Re: Issue with PA-1410 platform disk size

MRamadanAHafiez — Tue, 01 Oct 2024 05:44:25 GMT

have you or they managed to solve it? how ? is it possible to replacethe HDD with more storage one ?

Re: Issue with PA-1410 platform disk size

Brandon_Wertz — Tue, 01 Oct 2024 13:24:10 GMT

@MRamadanAHafiez wrote:

have you or they managed to solve it? how ? is it possible to replacethe HDD with more storage one ?

Your only solve is a larger 1k appliance or move to the 3400, or use some type of external log storage (Panorama, CDL, SEIM.) There's not a solve with the appliance model you have.

Re: Issue with PA-1410 platform disk size

BPry — Wed, 02 Oct 2024 00:37:59 GMT

Keep in mind that a lot of people are replacing PA-3200 series hardware with the PA-1400 series. This makes sense as PAN didn't previously have an intermediate platform between the PA-800 and the PA-3200 series, but the replacement for the PA-3200 is the PA-3400. The PA-1400 series replaces the PA-800 and it doubles the storage available from its intended predecessor, the same way that the other newer platforms do.

Your VAR/Partner likely did you a disservice by not mentioning the downgrade in storage that you'd be getting going with a smaller platform, but there's also a little bit of self-reflection that needs to go into that as well. The storage space available on each device isn't hidden information and would have been known if the question was asked prior to purchase. Since it wasn't asked, external log storage is the only real viable solution that you have going forward.

Assuming that you have even an old desktop laying around somewhere, you could use something like Graylog to build a completely open-source solution for keeping logs longer. It would just cost you some time to get setup and configured.

Re: Issue with PA-1410 platform disk size

Spiff_21 — Wed, 02 Oct 2024 08:53:15 GMT

the PA 820 had 256GB, the step up the PA1410 only have 128 GB, where acording to my Firewalls only 18GB are used for logging, this is really nothing like dobbeling, predecessor.

Re: Issue with PA-1410 platform disk size

Brandon_Wertz — Wed, 02 Oct 2024 15:53:01 GMT

@BPry wrote:

Keep in mind that a lot of people are replacing PA-3200 series hardware with the PA-1400 series. This makes sense as PAN didn't previously have an intermediate platform between the PA-800 and the PA-3200 series, but the replacement for the PA-3200 is the PA-3400. The PA-1400 series replaces the PA-800 and it doubles the storage available from its intended predecessor, the same way that the other newer platforms do.

Your VAR/Partner likely did you a disservice by not mentioning the downgrade in storage that you'd be getting going with a smaller platform, but there's also a little bit of self-reflection that needs to go into that as well. The storage space available on each device isn't hidden information and would have been known if the question was asked prior to purchase. Since it wasn't asked, external log storage is the only real viable solution that you have going forward.

Assuming that you have even an old desktop laying around somewhere, you could use something like Graylog to build a completely open-source solution for keeping logs longer. It would just cost you some time to get setup and configured.

This hits the target. Our Palo account team told us the 3200 replacement was the 3400, so that's what we went to. The 1ks are no where near the 32/3400s. I've heard a few stories where the 1ks are really under performing customer expectations because of the hardware limitations. The 1k is probably a great box, but it needs to fit the deployment requirements.

Re: Issue with PA-1410 platform disk size

MRamadanAHafiez — Thu, 03 Oct 2024 17:08:39 GMT

I will ask it frankly, is there away to replace the current har dsik with larger one??

We are thinking seriously of suspending the deployment.

If we have deployed panorama, will its syslog receiver stop if it was not licensed? Or it will keep on receiving the logs and reporting too even without licensing it?

Re: Issue with PA-1410 platform disk size

BPry — Thu, 03 Oct 2024 17:05:20 GMT

@MRamadanAHafiez,

The drive isn't user replaceable on the PA-1410, so you won't be able to just replace it like you can on some of the larger platforms like you could with something like the PA-3200 or PA-3400.

Re: Issue with PA-1410 platform disk size

MRamadanAHafiez — Thu, 03 Oct 2024 17:38:00 GMT

thanx, and what about "

If we have deployed panorama, will its syslog receiver stop if it was not licensed? Or it will keep on receiving the logs and reporting too even without licensing it?"