General Topics

Active/Passive vs. Active/Active

I am currently working on a network redesign project with all Cisco gear. Our network engineer is opting for a complete HSRP Active/Active environment. According to all deployment documentation, HA Active/Passive seems to be the preferred methed for the Palo Alto's. I see that the PA's do support A/A HA using VRRP, so I do not see a configuratio...

Cluster a 3020 with a 3060?

Can you form a HA cluster with a PA-3020 and PA-3060? Or do models have to be identical?

Resolved! Need Upgrade Tips

I am planning to upgrade Panorama and my few HA clusters to version 9.0.6. Currently all these are on 9.0.3-h3.Need your experience on 9.0.6 if anyone is already running on it. Is there any unknown issue/bug observed on this version?I have completely aware of known issues but just wanted to check if anyone observed any bug on this version and cr...

Resolved! SSL Inbound Decryption and Certificate with Wildcard mask

Hi Everyone, Hope everyone is staying home and Safe.I need to import the certificate and the private keys to the firewall from the web servers.We have this certificate say *.city.ca and this is associated with few websites like maps.city.ca. or recruiting.city.caAll these urls have same public IP address say 209.x.x.x When I import the certific...

Question about Service Route Configuration

I just inherited a PA-820 and know nothing about this device. It's unable to connect to the cloud for updates. Currently it's service route is set as the default (Management Interface). I was told by support to switch it to an untrusted interface to resolve this. I can see how that is done via this article: https://knowledgebase.paloaltonetw...

Cannot check for new Dynamic Updates

Hello, I have a PA-200, version 7.0.10 (I know, too old) I'm planning an upgrade to 8.1, but I understand that I have to download Dynamic Updates before upgrade, am I right? The issue is that I can't Check for Dynamic Updates, I've tried with Check Now, but nothing happened, neither with command request content upgrade check: Version Size Releas...

Files' upload problems

Hi.I'm searching for someone can help me.My problem started when I tried to upload custom logo for the login page.The upload fails becouse the process blocks itself and never ends.I had the idea to try the "Import named configuration snapshot" function in the same web page of PA3260 administration site.Thinking it would be failed, I used the log...

Denied traffic even though GlobalProtect HIP check passes?

Hi all, I have a PA-3020 that is configured for GlobalProtect. All is good as far as being able to connect to the VPN, but once I am connected I find that I'm having issues connecting to servers that are permitted in security policy, but have the HIP Profile attached. If I remove the HIP profile the traffic flows as expected. The HIP profile is ...

PA 820 to PA VM migration

we have implemented PA 820 in one of our client places now we are facing issues in hardware. We need to migrate the entire configuration to the PA VM series firewall. Let us know the procedure to migrate the entire configuration from PA 820 to PA VM Series.

Global Protect with SAML Azure Authentication and disconnect tab on client

We have configured the global protect 5.0.6 with SAML Authentication.It is same authen profile on both portal and gateway. I have unchecked the authentication override on both portal and gateway.Seems when i connect to the client and when i disconnect it does not send me push notification on phone?Is this the default behaviour? When i click on s...

Resolved! Management Interface Permitted IP Addresses & other devices

Hello all, Our PAN-OS Management Interface Permitted IP Addresses (on both Panorama and firewalls, version 8.14) contain IPs for the firewalls and both members of the Panorama cluster. These weren't set up by me and I'm wondering if that's necessary. I have read an article that said that that device configs, log retrieval, etc. are managed ove...

Exporting a list of Panorama managed devices with software version included

Does anyone know how to export, to csv, a list of all managed devices from Panorama? Thanks,

Resolved! Traps Uninstallation Issue

I’m trying to install the latest version CortexXDR 7.02 however I’m unable to remove the previous Traps installation that is still shown in the registry files. We are on current Traps agent 6.11.18549 and we can remove this successfully however unable to remove Traps agent 6.00.4961 This is what I’m using below in a batch file: (did not include ...

Resolved! Phone calls random failing to connect at remote locations - Cisco Call Manager

We are in the process of converting over to Palo Alto firewalls at our remote locations from ASA firewalls. A few of our sites now are having some strange issues when attempting to make phone calls.We are a Cisco call manager shop. Here is a basic setup of our network:Remote Office <-Site to site VPN tunnell-> Main Office Voice setup betwe...

Resolved! SSL inbound inspection delay

hey all, I've deployed SSL inbound inspection, connection gets really slow when SSL Inbound Inspection.It takes almost one minute for the page to be loaded. Without SSL it takes 2 secs. Would any of you have a clue what could be causing the problem?

Discussions

Active/Passive vs. Active/Active