Sizing help — university internet edge, 3 Gbps today, 4,000–5,000 students, 7-year lifespan. PA-3430 / PA-3440 / PA-5410?

Looking for sizing advice from anyone running PAN at a university/campus internet edge. Environment: University with 4,000–5,000 students plus staff/faculty Current internet bandwidth: 3 Gbps — expect this to grow substantially over the appliance's life (bandwidth per student keeps climbing; wouldn't be surprised to hit 8–10 Gbps by end of life...

Best free Syslog server 2026

Hi everyone, we are currently trying to set up a syslog server as we would want to retain older logs in case we need it for auditing purposes. We are looking for a free one that's good in 2026. I'm currently choosing between an ELK stack and Wazuh, which would be easier? I have experience in setting up Docker containers. Was looking at Graylogs ...

Sizing PA-Series for internet edge — 3 Gbps today, growing to 8–9 Gbps, with SSL decryption. Which model?

Sizing an edge firewall for a university campus and would appreciate real-world input from people running decryption at scale. Requirements: Internet edge only — no east-west/inter-VLAN (core switches handle that) Current internet traffic: ~3 Gbps, growing to 8–9 Gbps over the appliance's 5–7 year lifecycle Security profile: Threat Prevention (...

Quest ASC - TSF analysis tool manual

Hi All Is there any user manual or admin guide for Quest tool < https://quest-asc.paloaltonetworks.com/ >. Thanks in advance. Kind regards

Commit Protection – Automatic Restore Point Before Every Commit

The ProblemAs network technicians, we all know that committing a configuration is the most critical action on a firewall.Most commits complete successfully.Sometimes they don't.A wrong static route, a Virtual Router change, an interface modification or an incorrect NAT rule can immediately affect the firewall after the commit.The firewall is sti...

Is there a way to configure Pan-OS to integrate with an ACME server for certificate enrollment?

Hello, I am working with an IPsec VPN setup on my Palo Alto Networks firewall and am currently using certificate-based authentication. My organization utilizes an internal Certificate Authority (CA) that supports ACME (Automatic Certificate Management Environment) for certificate enrollment. However, I haven't been able to find any resources or ...

"Use Default Browser" option not showing in Strata cloud manager

Hello Team, We have client firewall managed with strata cloud manager. We were trying to use the default browser for SAML authentication. When we checked that option on firewall under GlobalProtect Portal > Authentication >"Use Default Browser" it worked. But we had to do that locally, because we do not see similar option in strata cloud m...

Study Material (PDF) for Next generation Firewall Engineer

Hi people,May I have the link to download the Next Generation Firewall Engineer study material, which is a PDF doc? I am looking to prepare for the certification. Thank you

validation error "poe unexpected here"

I'm trying to push policy from Panorama (11.1.6) to a PA-440 (10.2.13). In Panorama, when looking at the config of an interface such as Ethernet1/1, it has a tick box for "PoE". However, on the same dialog on the PA-440 there is no PoE depicted. Now, when i try to push policy (whether PoE is ticked or not) it comes back with: Validation Error:n...

SCM management routing mode change failed

Hi, I’m trying to manage PA-460 from SCM, but I still get error, even after a factory reset. The firewall still disconnects and cannot complete bootsrap process, but SCM receive telemetry data. I also try to change [routing mode] to advanced routing, same result. PAN OS version is 11.1.6-h3 (preferred) Strata cloud management essential No str...

PaloAlto vmware image download for lab perpos

Dear,I want to download the Palo Alto VMware image for lab practice

PA-VM KVM 10.2.5 Trial Setup Issues

Hi community, I'm trying to set up a PA-VM KVM lab in GNS3 on a native Ubuntu 26.04 host and running into an issue, Hoping someone with GNS3 + KVM experience can point me in the right direction. --- ENVIRONMENT- Host: Ubuntu 26.04 LTS bare metal (dual-boot, not a VM)- QEMU version: 10.2.1 (Debian 1:10.2.1+ds-1ubuntu3.1)- GNS3 version: 2.2.59- KV...

when I configure custom option 6 on DHCP, will it be over rides the primary and secondary DNS?

I see a log indicating that the number of hints exceeded 5,000 after the OS upgrade.

Hello Team, After upgrading the OS (11.1.6-h10 -> 11.1.13-h7), hint-related logs are appearing in the system logs. I am aware of the cause. I am not using Panorama, and the log forwarding profile has "Panorama" checked as the forwarding method, with this profile applied to the policy. However, despite having the same configuration, hint-r...