Someone override a Template config section on firewall. What's the best strategy to remove override and go back to panorama pushed config...
Hi,i have a pair of active-standby firewalls, managed by Panorama. My first attempt, when i imported those to panorama, i pushed one template to both firewalls and had issue with HA IPs, causing split brain.I recovered the firewalls and later imported and pushed templates from panorama, keeping separate ones for both active and standby Question ...
I'm working on a project to get information from the Palo Altos and use it for an input to a SIEM. I'm able to run the below and get XML output.curl -k 'https://<PAN>/api/?type=op&cmd=<show><system><info></info></system></show>&key=<KEY>'I would prefer getting this in json so I tried &...
show system files show -rw-r--r-- 1 root root 653 Dec 2 18:54 all_pktproc_34_8.0.9_37.pcap-rw-rw-rw- 1 root root 30K Dec 2 18:55 all_pktproc_34_8.0.9_37.info how can i know why system crashed? will this crash any outage to MP or data plane?
On our User Activity Reports, I'm seeing windowsupdate.com with a block-url action and malware category classification. The URL appears to be valid. Does anyone have an idea why this would be happening?
Hi, I am trying to create a configuration template which I can change certain variables and pushed the config to multiple firewalls.However PAN is not behaving the way I need. I have two problems which seems to be related to PAN's design.1) Even if you fetch the config in set mode and pasted in back in CLI due to strict reference check it fail...
We have several IPSec tunnels that connect to 4G devices to provide network access in the event of a primary circuit outage. These tunnels do not disconnect after the primary circuit comes back up. Is there a way on the PAN side to disconnect an IPSec tunnel if there has been no traffic on it in a given amount of time?we are using IKE V1 and sta...
Hi Gang,We have Palo Alto Panorama and Firewalls and yes all going smoothly, however, It is not the end once it is up and running. So I am keen to read on all what you do in the daily administration of your PAN environments. All I have really, in terms of daily administration is:I've got email alerts configured to say if HA kicks in, will look t...
We are using VM-100 and would like to use this as a load balancer for our Web services. We have checked the link below and would like to know if this EMCP load balance incoming traffic to Web servers? Or does this just load balance egress traffic between 2 different ISP’s? https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g00000...
Hi community, I want to configure a PBF rule in a shared gateway but i don't know how, can you give me an example for this?
Q: I'm using a PA-3020; is there any default data collection gathered with the GlobalProtect VPN client/agents, or do you have to provide custom registry keys to scan for Windows? And where can you actually find the information being gathered?
Hello everyone, In our environment, we deploy both PA-220's and PA-220R's in the field. Sometimes they are deployed in HA pairs. I noticed that there's two different types of Threat Prevention license available. PA-220 (Non Redundant setup)Mfg. Part: PAN-PA-220-TP-3YR PA-220 (1 device in redundant pair)Mfg.Part: PAN-PA-220-TP-3YR-HA2 PA-220R (...
Hello, We have PAN OS 8.0.3 with the GP client version 4.0.2 deployed to our clients. This works fine. I've downloaded GP version 4.1.0 on my machine and when I connect it asks me to downgrade to an older version. We haven't uploaded any GP client to the PAN itself. We want to deploy the new version to the users but we don't want them to see thi...
Hi all, The issue that I am having is that all my firewall logs in Panorama are behind in time. I have tried multiple KB articles and support basically went through all the KB articles I found such as restarting the management service, stopping and starting the logging service, and even rebooted our Panorama. After rebooting our Panorama I sta...
In the data center end, the Cisco ASA firewall is advertising the OSPF route and at the perimeter end Palo alto receives the route, and PA will be forward that route toward Internet communication. Expectation, if any, specific route received by Palo alto, it should be rejected or drop on Palo alto itself. Should not forward to any next hop. How ...
BPry
on:
Issues with connectivity between HA PAs and Nexus Leaf Switches
