About laurence64

HI   Sometimes these errors are due to a process or daemon being busy at the time of pushing, did you try again ? if you did is it still not working ? ... View more

Hi    There are a couple of things here to check, one would be the configurations that include the original IP of the Panorama, such as log collector groups and so on, as the traffic for the Panorama communication is running through the data plane of the firewall I would look at the session browser to see if these are just old sessions that are still active, if they are you could try clearing them, you can do this from the session browser by clicking the X at the end of the session entry, you could also try restarting the management server of the firewall using the "debug software restart process management-server" From the command line, you will lose the management connectivity to the firewall momentarily as it restarts but it should not affect data plane traffic in any way. Hope this helps.   ... View more

Hi    I know this is an old post, but I found it as I have some odd traffic coming from an Android device, this was traceroute to the internet on port 80. A few apps were not working and the inclusion of this in the rule did help to fix one of them, just wanted to add that I found this article from Palo on the subject https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClrNCAS   ... View more

Does anybody know if this ever happened? I am needing to do the same thing and cannot find any reference to the method to do it. ... View more

Hi   Yes, you can attach an elastic IP to the interface of your Panorama, at this point you will have the interface IP configured in Panorama as the Internal interface and the elastic IP configured as the public interface in the Panorama management settings. ... View more

HI    When you configure the public IP of Panorama you would enter the local IP (AWS Internal) and the public assigned IP for that interface, then you would configure the firewalls to connect to that public IP. Connectivity should be no issue at as it will be done over the internet, I guess all you would have to decide then is what to do with your security groups with regard to leaving them open or restricting them to the firewalls that will be connecting. Hope this helps.   ... View more

Unfortunately I would have to redact it so much that it wouldn't be much use, just a quick question, when you say device > admin roles are you referring to the device templates stored on Panorama or locally on the firewall ?   ... View more

Hi   That hasn't solved it unfortunately, I have still got the Vsys error, this isn't a bug 10.1.6 is it ? ... View more

The other way around, so the role for admin users was created on Panorama, this was applied to the users as well as the access domain, the role that was defined in that admin role for context switch does exist with the same name on the firewalls we are context switching to. Does the admin role that is defined for the users on panorama by defined in the context switch and then be present on the firewall as well ? ... View more

Hi    The error that we are getting is  The firewall in question has no VSYS configured and is not in multi VSYS mode, the error does change if there is no role configured on the firewall at all to, predictably, No role for user, there is no difference in configuration between the one that works and the ones that do not, I have also made sure that the contexts are all enabled in the access domain config. ... View more

@BPry    To be honest I was wondering the same thing, as this firewall is at home and therefore open to changes without restriction (the occasional evil look from the Mrs when the internet breaks aside) I removed the Header insertion and it did indeed disappear from the global find search, however your point is extremely valid and I have found that Global find can lead to more than one rabbit hole. ... View more

Hi,   I understand that when using explicit proxy you would have to contact your DHCP server initially as with any proxy, however I thought that when using GP it was DHCP that gave the addresses out from the Gateway but it isn't done using DHCP as the protocol so that was not possible. I did look at the registering of DNS but was cut short as the team that wanted the feature moved on to another method. I will look at the documentation again as you suggest to see how this could be achieved. Thank you for you reply.   ... View more