About batd2

@RSteffens This is indeed a tricky one. When I deploy new firewall with sub interfaces I always use aggregated interface, even with just 1 member. This make any future changes easier.   But in your case, one option is to take the set commands for the old subinterface, then modify them by replacing the name with ae and apply them to the aggregate interface. It will involve deleting the old interface, creating the new ae interface and applying the modified set commands.  It is  a bit fiddly and prone to errors, but it can be done.  Another option is to try the rename interface feature of the Expedition tool. Again it  is not easy to work with and  prone to errors. Maybe option one would be easier, if you don't have good experience using Expedition.  ... View more

@Kaliman The key in the command is you API key. Here are instructions of how to get it:    https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-panorama-api/get-started-with-the-pan-os-xml-api/get-your-api-key.html   Have you done a software upgrade recently? It is possible that Panconfigurator does not support the latest PanOS.  ... View more

@Don_McLaren Here are the instructions for adding new employee to your support account:  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClNaCAK   If you need anything more specific, you should open Administrative Support request or contact you Palo Alto Account manager.  ... View more

@Vijaygvasan This is very detailed issue description and as mentioned it is likely caused by a bug. Maybe it is better if you add all this to a support case.  ... View more

@BigPalo  You were correct that you need to use Ignore user lists. Please see article with detailed instructions:  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClZBCA0 ... View more

@Alpalo I presume you are referring to the firewall's managed IP address. If this is the case, the management IP need to be unique on each node.  You have two possible solutions for you task:  1. Enable firewall management on one of the data interfaces, e.g. ethernet 1/1. You can achieve this by applying interface management profile to it and enable ssh and https. It may also need security policies configuration . This will ensure management connections only to the active HA member.  2. The other more complex option will be to use some 3rd party load balancer appliance, which can detect the primary member through API calls and sent management traffic to it.  ... View more

Can someone help?  ... View more

@amna02rs Can you share traffic log for the failing connection and if possible the policy configuration?  ... View more

@Deepak25 Yes, you can configure only url log forwarding.  It is a little bit confusing, as mentioned previous data, url, spyware, etc. are all subtypes of the Threat syslog. However when building your log forwarding profile object (Objects>Log Forwarding), threat has a different meaning. Threat will cover any threat subtype, which does not have specific log type selector, e.g. spyware, virus, vulnerability. URL, data  and wildfire logs will not be sent if you configure only log type "threat".  ... View more

@alaa.alasmakh This is very extensive question to be answer in a forum, but maybe the link below can give you an overview of what XDR is:  https://www.paloaltonetworks.com/cyberpedia/what-is-xdr     ... View more

@mkd1995 Yes, this is possible. You can use Policy Based forwarding to create a match criteria (in your case application SMTP) and then route it over the VPN tunnel.  ... View more

@securehops Legacy mode will not be supported in 9.1/10 and to convert to Panorama mode, the appliance will need to see exactly 2TB disk. You will not be able to expand the existing disk. You will either have to add 2TB disk or convert Panorama to "management-only" mode   See article below:    "Expanding the log storage capacity of an existing logging disk is not supported, and Panorama does not recognize the additional storage capacity." https://docs.paloaltonetworks.com/panorama/8-1/panorama-admin/set-up-panorama/set-up-the-panorama-virtual-appliance/expand-log-storage-capacity-on-the-panorama-virtual-appliance.html   ... View more