Panorama Discussions | Palo Alto Networks

Welcome to the Panorama Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

Panorama changes after static route added

We have added a static route to our Palo firewall through Panorama GUI and before committing the change when we compare the candidate config to running config it shows removal of some static route metrics for all static routes, even though we only added one new route. We have added routes in the past and this has not happened. We don't think thi...

Panorama SD-WAN Zone Mapping? No longer needed or no longer available?

I know this has been posted in the past, but I want to check if there are some new answers before reaching out to our SE. There is a "known issue" where the zone mapping tab was removed from Panorama. The current documentation still mentions the need to map the pre-defined zones to existing zones when adding the device to SD-WAN or via CSV. The ...

Panorama REST API Discrepancy

Hi folks!I've got a pet project to automate the provisioning of our new site firewall templates via the Pano REST API. While doing some cursory looking, I noticed that there's no endpoint in the v11.1 API docs to interact with ethernet interfaces. I did some RTFM and noticed that previous API versions had the 'network/ethernetinterface' endpoint...

Can I Decrypt OpenVPN

Hello, I want to decrypt traffic to my OpenVPN server so I can perform URL filtering and IPS checks on users connecting to it. I have the OpenVPN server's CA certificate and key. Do you have any idea ?

push from panorama to PA firewalal failed because of " is already in use because of policy and NAT already in use)

Hi,We have panorama in 9.1.9 version and PA-220 in same version. we imported configuration from pa to panorama, added just e pôlicy rule and pushed again the template and device group to same firewall. but then we get always pushh failed with errors saying NAT rules and policy rules are already in use ! is that normal ? we have exactly the same...

Does Panorama Forward These Events to External SIEMs via Syslog by Default?

Hi everyone, We're currently integrating Palo Alto logs (via Panorama) into our SIEM solution (Wazuh) using syslog, and I wanted to confirm the log types that are forwarded by default or require additional configuration. Specifically, does Panorama forward the following events out-of-the-box via syslog? Malware/Spyware detections Command and...

VPN between palo alto and Meraki with dynamic WAN ip address

Hello Mams and Sirs... I am stuck in a unique issue. Meraki has 2 WANs - primary one is static and secondary one is dynamic. They have 4 Lan subnets. The initial plan was to use their FQDN as remote peer and they would take care of the VPN failover. But, in ikev2, we could reach only one of their 4 subnets. When I switched to ikev1, I could rea...

Limitation on Panorama (license) used by VM-series

Hello experts, Not sure this should belong to Panorama or VM-series, We have a Panorama for log collection already for on-perm ngfw.Planning to purchase more ngfw firewall for AWS and Azure with BYOL (NGFW credits) 1) is there any limitation (e.g max number of Gateway managed) if we also purchase the credits for panorama (for mgt and logs) ? ...

Admin GUI Login Fails on WAN Interface - Slow Load & "Single Sign-On" Error on PA-410

Hello Community, I'm hoping to get some expert advice on an issue I'm facing with a single PA-410 firewall. I've done some initial troubleshooting, but would appreciate a second opinion on the cause and the best path forward. The Problem When I enable management access on our public WAN interface (ethernet 1/1), I cannot log in to the Admin We...

Firewall rules not getting reflected in Cloud NGFW

Hi, We have a on-prem Panorama which manages Cloud NGFWs. We have observed intermittently that the Firewall rules deployed from Panorama are not getting reflected in Cloud NGFWs. There are no visible errors that are generated with Panorama showing the deployment as "Completed". Is there any reason for which it could be happening ?

Panorama can't show specific timeframe log

Hi community, I have a question. I’m experiencing an issue where Panorama does not show logs for a specific time frame. However, when I check directly on the firewall, the logs for that time frame are visible. I've already confirmed that the log forwarding configuration is correct, and everything seems to be working fine—except when filtering ...

panos_commit_panorama commits all pending changes regardless of user specified in admins list.

Ansible playbook snippet: ------------------------------------------------------------ collections: paloaltonetworks.panos vars:panorama_provider:ip_address: {{ panorama_fqdn }}username: {{ username }}password: {{ password }}tasks: name: Commit Configpanos_commit_panorama:provider: {% raw %}"{{ panorama_provider }}"{% endraw %}sync: trueadmins:...

Resolved! Using Panorama to change controlled firewalls Active/Passive

I am upgrading all my controlled firewalls using Panorama. I am able to upload, install, and reboot my passive firewalls. But now I need to switch my active/passive firewalls. Is there a way to do this in Panorama? Before I would manually login (GUI or CLI) to each active firewall and use the suspend function to force fail-over. If there is a...

Panorama shows "error: Failed to set disk X sb"

Dear community! Our Panorama VM is working fine but is showing the following error logs in the config.log file: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2025-06-10 04:59:16.701 +0200 Error: pan_cfg_mgr_update_sysd_sstat_diskusage(pan_cfg_mgr.c:11672): Failed to set disk 3 sb2025-06-10 04:59:16.873 +0200 Error: pan_cfg_mgr_update_sysd_sstat_diskusag...

DR Panorama facing issue with the login when performing failover from DC to DR

Dear Team, One of our customers is using Panorama for both their DC and DR locations. When the DC Panorama is active, they are able to log in successfully to both the DC and DR Panorama. However, when a failover is performed and the DR Panorama becomes active, they face an issue logging into the DR Panorama, even though the same credentials work...

Discussions

Welcome to the Panorama Discussions!

Panorama changes after static route added

Panorama SD-WAN Zone Mapping? No longer needed or no longer available?

Panorama REST API Discrepancy

Can I Decrypt OpenVPN

push from panorama to PA firewalal failed because of " is already in use because of policy and NAT already in use)

Does Panorama Forward These Events to External SIEMs via Syslog by Default?

VPN between palo alto and Meraki with dynamic WAN ip address

Limitation on Panorama (license) used by VM-series

Admin GUI Login Fails on WAN Interface - Slow Load & "Single Sign-On" Error on PA-410

Firewall rules not getting reflected in Cloud NGFW

Panorama can't show specific timeframe log

panos_commit_panorama commits all pending changes regardless of user specified in admins list.

Resolved! Using Panorama to change controlled firewalls Active/Passive

Panorama shows "error: Failed to set disk X sb"

DR Panorama facing issue with the login when performing failover from DC to DR

My Panorama account is locked. Is there any way to fix this?

Device Group "Shared" available in Policies tab but missing in Objects tab

resolve hostname in logs now working in panorama

IoT Devices in Panorama

All committed entries with commit version < 3434 have been cleaned up from the replay database.

Re: what is the difference between "commit to panorama" and "save changes"?

Unlock your full community experience!

Resolved! Using Panorama to change controlled firewalls Active/Passive