Issues and Observations Upgrading to PAN-OS 7.1.7

Hello Everyone,

We are in the process of upgrading our firewalls to PAN-OS 7.1.7, and have come across a number of issues and oddities, and figured
it would be a good idea to create a community post to document them so that they might be a reference fo

PA lost mapping

hi, we are expecting problems with group-mapping. Yesterday we deleted a group from group-mapping profile and suddenly PA lost match in all the rest of groups in this group-mapping profile. we ran show user group-mapping state all and Number of group...

VPN Client, Can't connect to internal zone?

Hi, Good day!

I would like to ask what would be the problem,

From outside user accessing via ssl vpn (VPN ZONE) below details are working.

1. It can connect / has the ip pool assigned

2. It can reach the internet using the assigned pool.

Problem is fro

Pros and Cons of v-wire

I'm setting up a PAN firewall between our company and our business partners who have direct connections to our LAN.  My idea was to use v-wire but some of our other network administrators say it would be too difficult to troubleshoot.  What are the p

Virtual router from firewall in series with physical router.

If I change our virtual wire setup to layer 3, have the IP addresses on both interfaces be local network IPs, and set a static route for 0.0.0.0 to point to the existing physical router on the WAN side of the virtual wire, will traffic (tagged and no

Commit failing

Running a VM-300 on PANOS-7.0.3

When attempt to make a commit (either through GUI or CLI), it hangs at 98%, and then fails.  The commit failure outputs the following:

API timeouts/Web UI unresponsive

Hello,

Managment plane stops responding when sending a number of User-ID XML API calls to FW (tried using PAN-OS 7.1.5 and 8.0).

Any API calls during this time either time-out or return 502/504 HTTP responses.

After close to exactly 5 minutes later fr

What kind of speed should I expect from client VPN connections?

We are looking at a new PA 5250. We currently have a PA 5050 for testing. Last night I was getting about 70mbit/sec on my home cable modem. I can get 300mbit/sec without the VPN. A really old Cisco ASA was giving me about 30mbit/sec.

Any thoughts on

BGP establish state flapping.

I have couple of bgp established on the firewall. Confiugured new one to AWS ,tunnel comes up but Bgp is flapping.

System logs.

BGP peer session enters established starte,peer ip:169.254.32.1

BGP peer session left established state,peer ip: 169.254.32.1

Select route with shorther prefix length

I have a static route for 172.16.0.0/12 but my PA is also learning through OSPF a route for 172.16.0.0/24.

As these routes have different prefix length both are installed in the routing table and the dynamic route for 172.16.0.0/24 learnt through OSF