Advanced SD-WAN for NGFW Discussions

Welcome to the Advanced SD-WAN for NGFW Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

Request for SD-WAN Deployment Documentation in Azure

I need to integrate the Palo Alto firewalls deployed in Azure into our existing SD-WAN setup. Currently, seven offices are already connected through SD-WAN. The Azure VM‑500 firewalls are configured in an active‑passive setup and are managed via Panorama.It would be very helpful if you could share any SD-WAN deployment documentation or reference...

PAN-308564 Known Issue

I could not help notice that all of the latest and preferred 11.1.x, 11.2.x and even 12.1.x all have the following known issue. PAN-308564 Packets are dropped on SD-WAN interfaces if they require fragmentation for an interface but have the Don't Fragment (DF) bit set. This results in unexpected packet drops. This affects client to server...

Schedule automatic backups on Palo Alto ION 1200

Hi team We need to scheduled automatic backups for our ION devices Can anybody help us? Is there a API or other way for do it? Regards

From Template Stack Override

My Pa 850 is joined with Panorama. I am unable to do any config even if I config any sec rule, i am unable to commit

DHCP Relay over SDWAN issue

Hello all, DHCP relay is configured on the firewall over SDWAN the device acquire the IP normally but after some days it stop working and need to clear the session so any device can acquire an IP. The DHCP relay was working fine before implanting the SDWAN no issues at all but after the integration of SDWAN the issue start so what could be w...

I have concern in SDWAN, Kindly help out this.

1. Currently, four tunnels (at each of the two Hubs) are used for the four IPsec tunnels between these two Hubs (based on two SDWAN circuits at each Hub). Can the four existing tunnels (labelled tunnel.50xx) at both existing hubs (CHT and ELP) be used for the new IPsec tunnels to/from Agave2? 2. Can we use IP addresses assigned directly to int...

Prefered version for IONS

Hi team I am looking for a Prefered version for IONS devices Can anybody helps me? Regards

SD-WAN failover hub internet access via one of branches.

Guys, anyone know how to configure internet failover for hub to use MPLS link to one of branches in similar way that you can achieve DIA Internet access failover for branches? We have only one internet link in each office and MPLS between offices.

Resolved! SD-WAN Licensing in HA Pair

Hi, Does the SD-WAN license apply to each FW individually or to the HA Pair?We are deploying PA410s in out branches. This FWs will be in HA A/P mode and with SD-WAN managed from Panorama.I was wondering whether we have to adquiere 2 SD-WAN licenses (one per Firewall) or just 1 per HA Pair.Thanks!

ION Security Stack

Hi I am setting up the NGFW / Security Policy feature on an ION1000 running OS 5.6.17-b1 Enable L3 Direct Private WAN Forwarding? - YesEnable L3 LAN Forwarding? - Yes I have created 2 VLANs (Say VLAN 100 & 200) on the LAN side & an Internet connection The Security stack has been configured to allow traffic from both VLANs to the Inte...

SD-WAN Issue: Some Traffic Not Matching the Expected Policy

Hello everyone, I’m facing an issue with Palo Alto SD-WAN on Panorama (FW PA-1440). I created an SD-WAN rule to direct traffic for the ms-update application through a specific WAN link. However, when I check the traffic monitor using an ms-update filter, I notice that some packets match the "unmatched session" policy, while others correctly matc...

Zscaler IPSec tunnel over Palo alto SD WAN

Hi, Sorry for the long post. We have migrated from ASA to Palo alto firewall 445. We have Zscaler tunnel from Palo alto with PBF however monitoring was failing to switch over. We have second circuit now, tried to do ECMP with the tunnel interface and nothing worked. I have added the default route to tunnel (and higher metric to DIA) and cha...

SD-WAN overlay routing

Hi There, Can anyone share how the overlay routes are visible through CLI or GUI?

Filter BGP Advertisements from SD-WAN Branch

Hello, Im testing out Palo Alto SD-WAN with Panorama and am using BGP with Auto-VPN. Because Panorama is pushing the BGP configuration in the background autonomously, im not able to see that config in Panorama, but it reaches the firewall and all is working. However, some of the sites, I don't want to redistribute some subnets (guest networks), ...

What exactly is new in the advanced SDwan for NGFW?

What exactly is new in the advanced SDwan for NGFW license compared to the legacy SDwan for NGFW license? All of the other "advanced" licences got some improvements, mostly related to inline DL or ML mechanisms, but what is new for the SDwan license?

Unlock your full community experience!

Resolved! SD-WAN Licensing in HA Pair