About RyanJohnstone1144

Hello,   We have a couple of VM-300 series firewalls in Azure which are using HDD disks.  We have had a recommendation to change these VMs to standard SSDs disks to improve performance as part of a recent health check.  Can anyone advise if this is worth doing and any issues we may come across in doing so?   Thanks   Ryan ... View more

Hello,   i want to do a packet capture on a VM interface using Network Watcher for some traffic on our VM-300 series NGFW but our CSP advises this is not possible.  The extensions section in Azure seems to confirm this.     can anyone advise if this feature is available?  we are having issues with a flow of traffic not being received at the far end but the PA is saying it is sending it, i need to do a capture outside of the PA to see if the traffic is definately being sent.   thanks ... View more

hello, we are setting up SSL Inspection for inbound traffic but it is failing when clients try to access, we are getting unsupported protocol errors.  ssl labs shows the following issues around handshaking.     with SSL Inspection off we do not see these errors     can anyone advise what we can do to address this?  we are running PAN OS 9.0   Thanks   Ryan ... View more

Hello,   We have a pair of VM300 PAs in Azure set up in Active-Passive.  They are running 9.0.7 code with VM Series plug in 1.0.8.    There was an issue in Azure on 19/10/20 which caused a failover and recovery (we use pre-emption).  Post this issue the PAs were up and running but not passing traffic.  we found that the secondary IP addresses (i.e. floating IPs) had been moved to the Azure VM for the Passive firewall (PA2).  Hence no traffic flowing as this firewall was passive.  We failed from the Active (PA1) over to this Firewall (PA2) and some traffic started to flow but everything was incredibly slow.  we tried restarting VMs, failing back over, etc but nothing would change the state of the secondary IP addresses, they were locked to PA2.   Eventually we completely powered down the VM which was running PA1 and things started to run ok again.  we then configured PA2 to always be Active and powered PA1 back up.  PA1 came back up, re-established HA and things were running fine, PA2 Acitve, PA1 Passive.  We then suspended PA2 to trigger failover and again we had issues with secondary addresses.  The secondary addresses on the untrust VM interface floated over to PA1 correctly, but the secondary address on Trust VM interface disappeared completely from both PA1 and PA2.  No failovers, restarts etc recovered this address.   We powered down PA2 and had to manually re-create the secondary address on Trust on PA1 to restore service.  this is the state we are now in.   can someone please assist / recommend next steps?  Failover it seems is broken.   thanks   Ryan                       ... View more

Hi all,   We are looking to set up a HA pair of 9.0 PAs in Azure as per guide below   https://docs.paloaltonetworks.com/vm-series/9-0/vm-series-deployment/set-up-the-vm-series-firewall-on-azure/configure-activepassive-ha-for-vm-series-firewall-on-azure.html   I have a query around the creation of the Azure AD application referenced in the above link, this directs me to link below   https://docs.microsoft.com/en-gb/azure/active-directory/develop/howto-create-service-principal-portal   When we create the applicaiton we have the option for a redirect URI, do i need to put anything in here?  i know it is flagged as optional but if i leave as the defaults would this cause an issue?   Ideally if anyone has an example of creating an Azure AD application for an Azure HA PA setup it would be most appreciated.   Many thanks   Ryan     ... View more