About davanderson

You would normally have a dynamic routing protocol setup to allow traffic from one site to another via your MPLS network.  Then you can easily use your default route to send traffic to the Internet firewall for your backup VPN tunnel.   This is an example of how a network would likely be setup to serve the function you describe.  When the MPLS goes down, you lose the dynamic routes and the VPN kicks in.   ... View more

Hello Ryan,   Here is a guide for best practices on the PA upgrade process:   https://live.paloaltonetworks.com/t5/Featured-Articles/Best-Practices-for-PAN-OS-Upgrade/ta-p/111045   Section 4 outlines the process you are looking for.  After your backups and testing / validation the process is essentially this:   = = = = = = = = = = = = = = = = = Suspend the Primary Upgrade the Primary Reboot the Primary Resume the Primary = = = = = = = = = = = = = = = = = Suspend the Secondary Upgrade the Secondary Reboot the Secondary Resume the Secondary = = = = = = = = = = = = = = = = = ... View more

Hi Andrew,     You don't need to install the intermediate software updates and can go to the latest version.   Please keep in mind that if you are going to upgrade your firewall from one major version to the next (say version 7.x to 8.x) you will need to download the base image for the major release before installing the patch fix.  (You don't have to install that base version, only download it.) ... View more

Interesting question.   Back in 2012 - this was not an option.  You could only go like for like hardware.   https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Save-an-Entire-Configuration-for-Import-into-Another-Palo/ta-p/61476   I would suggest a command line migration.   I prefer the "SET" command line commands.  Dump the full 500 series configuration to text file via the SET language.  Then modify the configuration to match your interfaces and then paste it back into the 800 series unit.    Tera-Term pro has an option to allow you to limit the number of copy/paste lines per second.  Bump that up to 1 command every 500ms and this should allow you to paste the entire configuration in one go. ... View more

This isn't a function of the VPN client, but a function of your usage.  If you connect 2,000 people and use RDP @ 250Kbps then you would need a 500Mb connection (assuming they are all using this steady amount of traffic all at the same time).  If you have people using various applications such as Word, Excel, Outlook it will vary.  I would suspect that a 200Mbps Internet circuit would be fine.  Note:  This is a dedicated business class service from an actual ISP (such as Level3) and not a cable company or home user type service (think Comcast/TimeWarner or Verizon Fios).   I've never had to limit user speed on the GP vpn.  I don't see an easy option. ... View more