Starting with Palo Alto Networks - What I wish I had known...

[carnould]

Beginnings are not always perfect.  Whether you started your Palo Alto Networks journey years ago or just recently, tell us what you learned early on that you wish you had known before. 

If there was one thing, or maybe more, Live Community users would love to hear about it.  Share your stories, your tips to help other users along the way.

Read a tip you like, make sure to like it or let them know by commenting!  

The most popular and helpful stories will get you a cool new Live Community t-shirt!

Looking forward to reading all the great stories!

@carnould

[carnould]

And the WINNERS SO FAR ARE:

Published in LiveWeek 12 Friday April 7th 2017.

Your time to share - "What I wish I had known"

Community is all about sharing ideas and best practices.  Whether you started your Palo Alto Networks journey years ago or just last month, your experience can really help others.  Share your story with other Live users. 

Thanks to @santonic, @DPoppleton, @BPry and @jjb3k for all the valuable insight - each user will receive the hot off the press Live Community t-shirt!

Keep sharing - more t-shirts to grab!

[DPoppleton]

Do you need any info from me for the shirt?

[nikoo]

Hi,

Beginning are always clumsy, but one of the first things I was impressed - community and knowledge base articles. I cannot stress enough how many times articles around here have helped me to get around some issues or simply get to know some feature.

Anyway, when I got into PA firewalling, it all looked nice and shiny and overall easy to deal with, so it felt good, but some things I've learned over time:

• Subscribe for Security Advisories, Software Update & Content Update e-mails - that way you will always know when new feature release comes and will not miss more severe notifications about vulnerabilities - in such a cases every minute counts.
• Use packet capture - that has proven my point countless times - if, for any reason, you do not believe logs - getting the capture in such a cases is easy & fast way to see what really happens from a different directions.
• Learn some basic CLI - they WILL become handy one day and when that happens - it may be already stressful enough as you will not go there unless there is a really good reason. Know how to deal with HA from CLI, log structure, running debug packet diag, flow basic (https://live.paloaltonetworks.com/t5/Featured-Articles/Getting-Started-Flow-Basic/ta-p/72556), etc.
• Superb feature I learned about after a while - https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Test-Which-Security-Policy-Applies-t.... Testing policy match from the CLI - that really helps to understand if the traffic will pass without bothering the end-user. P.S. TCP - IP protocol 6, UDP - 17. Good to know when testing. 🙂
• Features that are synchronized in HA - https://live.paloaltonetworks.com/t5/Tech-Note-Articles/High-Availability-Synchronization/ta-p/61190. Had to deal with the question - why the heck secondary device is not getting the updates from the Internet although the network setup should allow it, but, whooaaah, service routes had to be set for both devices of the HA pair saperately as they are not synced in HA.
• Although it was not possible in early PA releases - it is possible to log the default security rule traffic - https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-See-Traffic-from-Default-Security.... I've seen some creating custom "catch-all" rule for the traffic just for the logging - not required anymore. I was told it is not possible and it turned to out to be legacy and wrong.

..and there are definitely other things, but as you see all of these are well described in Live community - you still have to find them though. 🙂

[santonic]

Thanx @carnould for the t-shirt! it arrived quickly! 🙂

[oscaringosv]

"What I wish I had known" that a complex administration appliance (Panorama) will help me in one or two clicks to apply configuration changes to almost 100 firewalls in a few seconds and not go firewall by firewall that used to take me a few hours, now it makes our company happier and more secure, quick example would be deploying an emergency content updated. WAY FASTER, thanks to Palo Alto Panorama :). 

P.S: Almost all of my questions or steps by steps procedures (Like 80% of the time) are here in the community.