About doug-elliott

I did have an issue with the DNS sinkhole configuration and TAC had issues discovering the root cause.  A change in the way the newer configuration version botnet syntax was the cause.  I feel much more comfortable merging the old config into the base config of the newer version.  No issues yet and no TAC cases.   ... View more

If the PA-3020 is at pan-os 9.1 and the PA-460 minimum pan-os is 10.2, would you not need to account for configuration differences by migrating with Expedition using the PA-460 as a base cfg?  botnet config lines as an example are introduced and move within the cfg depending on the version.  ... View more

Planning a SonicWall (SW) migration.  Putting this method in my toolbox.  Would beat a manual build on a Day1 cfg.  I was hoping to get the policies out of the SonicWall into csv format and manipulate for use.  From a July 2020 SW forum post, "Access rules export is available by default from next generation firewalls (Gen 7)"  I don't think I have Gen 7 SWs but still gathering info. Also in the post, the "MySonicwall tool" will convert a SW cfg backup into text file.  I found the online SW Migration tool but I think the MySonicwall tool requires a support logon.  Thanks KenLynch. ... View more

Is there a status on this fix? ... View more

I used this document -- https://supportcases.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClFoCAK -- and instead of "none" for username in the cert profile, I used `Subject'. ... View more

UPDATE:  TAC response. For remote user authentication to GlobalProtect portals and gateways, the firewall integrates with MFA vendors using RADIUS and SAML only. As of now, The Google authenticator app is not supported by Palo Alto for multi-factor authentication. Supported MFA vendors are Okta, PingID, RSA token, DUO. Below document explains about the Multi Factor authentication in detail. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CmSm https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/authentication/authentication-types/multi-factor-authentication ... View more

Same here minus the RADIUS server.  If I avoid using two-factor authentication with GlobalProtect to authenticate to the gateway or portal, it should be possible to use GlobalProtect to notify the user about an authentication policy match (UDP message), a Multi Factor Authentication server profile would be sufficient, yes?  Specifically, I would like to know how this would work with Google Authenticator. ... View more

Same principle applies to Panorama management of firewalls as with log-collectors.  Panorama must be at the same level of PAN-OS code or higher. ... View more

you might be able to pull the PN cfg into Expedition with the base config from your VM to produce XML for a load merge, API cfg push, or to parse objects from the file for Ansible. ... View more

@gulruthina , the 300E seems to fit between the pa-850 and pa-3220.   https://www.paloaltonetworks.com/products/product-comparison.html?chosen=pa-850,pa-3220 Could go either way depending on overall requirements.    If you are a partner, check out the competitive intelligence available on the nextwave partner site for additional comparative analysis.  ... View more

@BPry , @Jim.Fallon , wouldn't it be nice to have a REGEX repository filled with data pattern strings written for Palo Alto?  I'm in the same boat where for PAN-OS 9.0, predefined patterns are mentioned to respond to HIPPA but there are none listed.  Financial and PII are mostly covered but nothing health related.  I need patterns for Medical forms and codes.    If we have to write them (ahead of PAN-OS 9.1 DLP subscription use), where can we share them?  ... View more

Is there an update?   1. Is there a way to pull the VPN config from Checkpoint R80 (.jar file does not) and 2. Can Expedition migrate the VPN configuration? ... View more

Thank you @dgildelaig , I thought the .jar file was produced by paloalto.  The client did not recognize the file's origination and I'm not familiar with Checkpoint.  I could not have wished for a better answer.  ... View more