Hide/show local configuration objects

Was running 9.1 on all firewalls. 10.0 on Panorama. Then something stupid happened and couldn't sync my HA pairs. I was forced to upgrade everything to 10.1.5. In the name of all that's stupid, on my local firewalls, when I log in, it shows me both the locally configured ipsec tunnel and the panorama configured tunnel object (the green gear)...

How to onboard palo in to panorama

Hi Team, Our palo already onboarded in to the panorama. Due to some reason our L3 team disabled panorama setting in the palo. Now we need to re-add in to the panorama. Please tell me how need to do? 1. Palo we need to enable pano setting only enough 2. or we need to import the config in the panorama as well ?

shall we do commit operation and dynamic updates installation at the same time from Panorama

Please let me know if we can do commit operation ( for example a firewall policy push ) and dynamic updates ( for example App and threat installation) at the same time from Panorama.

Panorama Collector Log Forwarding not working

I noticed an issue with this feature before when I tried to set up an outgoing email on the Correlated Events log settings in the Panorama built-in collector group. My idea was to filter to certain networks and then send an email when a correlated event came in that matched the filter so that a ticket could be created and our desktop services f...

Panorama GUI login fails with error 403 forbidden

Getting error message as "error 403 forbidden" when trying to access panorama from IE,Firefox browsers which used to work fine earlier, however the cli seems to work fine. Any possible solution on this ?

question about panorama and proxy server

Hi，Bro The customer's network environment does not have direct access to the Internet, but wants panorama to update the contents and software of the managed firewall device through a proxy server. So the proxy server is configured to allow access to updates.paloaltoneytworks.com. We found that only updates.paloaltoneytworks.com is released on th...

Panorama - Force Template Value Option

Hello good evening: As always, thank you very much for the support, collaboration, support and help. I have the following important question regarding a PANORAMA function, in relation to the "Forced Template Values" option.According to the documentation, this option performs the following function:Merge with Cadidate Config = Option to merge t...

Panorama 10.1.6 wants to push keys and secret every time

Hi all, I want to upgrade my Panorama, 220s and 3220s from 10.0.10 to 10.1.6. I started upgrading Panorama and a 3220 HA Active Passive Pair to 10.1.6 No issues during update. When I want to push config to devices, I notice that the 3220s are shown "in sync", but when I go to the diffs, it always wants to push modified keys and secrets: IPSec Tu...

Panorama Template Push to Firewall always fails, unless you push Device Group at the same time

Panorama - VM ESXi - Panorama mode - version 10.1.4 When Panorama Template Push to Firewall always this always fails, reports out of sync and when you log directly to the firewall you do not see the changes. When you push Device Group and the Template from Panorama to the firewalls, the Template changes are successfully. The options enabl...

Panorama template section is empty : No interfaces, no zones

Hello team, I have 2 firewalls managed in my panorama. When I go to template section on Panorama I can not see anything, any interfaces, zones so it's not possible to make any change from the Panorama. I have to make changes directely on the firewall. Do you know how can I fix out this issue ? Kind regards

Is it possible to exclude a particular IP from forwarding logs to the syslog server, that too particularly deny logs for that IP

Bulk add existing addresses to an existing group

Hello,I'm hoping someone can help out. I've just finished a merge from an ASA to Palo Alto through Expedition. The ASA had 3000+ addresses as part of an existing address group. I've tried multiple times to merge, and push the changes through the API, but it would appear all the addresses don't show up in the group.I guess what I'm asking, is ...