Questions on Palo Alto safe practices

[srikanth]

Hi i have a few outstanding questions on Palo Alto devices. We just migrated from Juniper to PA line. So these might sound silly for people who already are on PA line.

1. Do we have any primary and back up images on PA firewall . Just like in JUNOS if one image is corrupt it tries to load from the back up image file.
2. How many rollbacks does the PA device support by default ? Can we actually delete some of them if we don't wish to have them on the device?
3. How do we load factory default configuration on the device ? What does the factory default config contain ? Does it have some templates?
4. What are the safe practices in operating a device ? Powering off and on PA firewall do we have some CLI commands ? I think we have a restart option in WEB GUI . But wanted to know about halting and forceful power off.
5. How do we clean up the database once it is full ? Can we delete the logs like system logs and all?
6. Flow diagram keeps changing in all of the modules (eg NAT ) . If you can throw some light on that , it would be helpful.
7. Can we apply import policies for route redistribution? The reason why i ask this is i did not find any import for RIP , OSPF except for BGP.
8. When we are configuring DNAT, what should we match on the destination IP address ( the pre NAT IP ) and i check mark on translated packet and give my post nat ip ? But i could not implement that on my device for some reason. Same goes with Static NAT
9. When doing lab on Route redistribution , i matched on my default route and tried to redistribute that in OSPF but for some reason everything was visible except my default route which i exported in OSPF.

Hoping to get answers for these .. Thanks a lot guys !!

[ppatel]

Srikanth,

At this time there is no way to remotely turn off the the device using the CLI.

Once you restart the system , the first process the device does is auto-commit. The management plane of the device comes up first and then the dataplane.

So we need to wait for the auto commit to complete. Having the access of device GUI , does not necessarily mean that the device is ready to pass traffic.

If the auto commit is not complete we see the system initializing message, we can either wait or bypass it by allowing it to run in the back ground.

Autocomm can be monitored by the following command:-

>show jobs processed

Regards

Parth

[ppatel]

Srikanth,

Netflow documentation :- https://live.paloaltonetworks.com/docs/DOC-2014

Tap mode implementation is to monitor the traffic over the network by not being inline:Generally this feature is used for evaluation/ POC etc. So to answer your last question , YES  you can replicate the real time traffic on your firewall before you deploy by using tap mode https://live.paloaltonetworks.com/docs/DOC-2561

V wire implementation is like a bump-in-a-wire. Being inline and passing traffic through the firewall.

Regards

Parth

[srikanth]

Thanks Parth very useful info.

Can you help me how to register Panorama and add devices with that?

I was given Panorama Auth code but not sure where do i use that.

Also i have device serial nos and auth codes but when i add that in Panorama it says auth code already used.

Not sure whats wrong with that. I followed admin guide when doing this

[ppatel]

Srikanth,

Here is the document on "how to register a device and activating licenses:-

https://live.paloaltonetworks.com/docs/DOC-1257

Also go through the document below  to get  software downloaded for panorama

.https://live.paloaltonetworks.com/docs/DOC-2331

I am sure tou will find this helpful.If so, feel free to mark it.

If you still have problems registering the device/panorama please open a support ticket.

Also I highly encourage you to create a new discussion thread for each topic.

Regards

Parth

[srikanth]

thanks for that ..

I did not get any serial no with panorama when i purchased these neither do i find it under the device tab .

Please find the attached

[ppatel]

Srikanth,

This means that panorama is not registered.

Unable to Activate Support on Panorama

You should have the "Order Summary for Palo Alto Networks Order" e-mailed to you, which will contain the Panorama S/N.

If you cannot find it please contact your Authorized service center or Reseller from whom you got the device.

Regards

Parth