About Remo

A good start is here: https://www.paloaltonetworks.com/documentation/80/pan-os/xml-api  About the scripting part: here you can use what you want: Powershell, phyton, bashscripting, ... just something, you're comftable with. There are also modules available which probably make the use of the API even easier (just modules I found, I did not test them): - powershell: https://github.com/brianaddicks/poweralto2 - phyton: https://github.com/kevinsteves/pan-python   But to begin I think the best way is simply to follow the steps as described here: https://www.paloaltonetworks.com/documentation/80/pan-os/xml-api/get-started-with-the-pan-os-xml-api - enable API access - get API key - do your first query - api browser   After that with a little knowledge of a scripting / programming language your prepared for writing your own scripts.   And for every problem you run into with your chosen language, remember: google is your friend, because most likely others already had the same or similar problems 😉 ... View more

@TranceforLife Explain how to use the monizoring script or scripting/API in general? ... View more

Yes I see, probably a little outdated ... ... View more

Hi @ansharma   Does this document still fully apply to 7.0/7.1 and also 8.0? https://live.paloaltonetworks.com/t5/Tech-Note-Articles/High-Availability-Synchronization/ta-p/61190   Regards, Remo ... View more

Here is a document about what is synced and what not in active/active and active/passive clusters: https://live.paloaltonetworks.com/t5/Tech-Note-Articles/High-Availability-Synchronization/ta-p/61190 ... View more

@ansharma wrote: Honestly, from my experience I have seen the bug hit on platforms other than 200, albeit rarely. Ideally, you need to only download the base image and then download-and-install the higher version. But regarding upgrading to 7.1.x, you should download-and-install 7.1.0 and then download-and-install 7.1.x.   The bug was fixed in a later version in 7.0 code.   Lucky me, that I experienced this problems only on our PA-200 clusters 😛 ... View more

Hi @javier.brito Unfortunately out of the box there is now way to view QoS statistics. Maybe today there are other methods but 1.5 years ago I wrote powershell script which could be used with PRTG Traffic Monitoring. Thats the way how I solved this problem: https://live.paloaltonetworks.com/t5/Automation-API-Discussions/QoS-Monitoring-for-PRTG-Network-Monitor/m-p/67436#M1177 Cheers, Remo ... View more

If you are talking about a PA-200, this article may be explains the situation: https://live.paloaltonetworks.com/t5/Management-Articles/Software-Upgrade-Problems-on-PA-200-Devices/ta-p/63178 Here are some more informations about how and also when you should delete some local files: https://live.paloaltonetworks.com/t5/Management-Articles/How-and-When-to-Clear-Disk-Space-on-the-Palo-Alto-Networks/ta-p/55736 ... View more

commit = Commit to panorama commit-all = push configuration to managed firewalls https://www.paloaltonetworks.com/documentation/80/pan-os/xml-api/pan-os-xml-api-request-types/commit-all#_69146 ... View more

Even there is a serialnumber range mentionned for affected devices only devices listed in the PA200 Validation Tool are affected even your device has a serialnumber in this range.   If your device is not listed their you don't have to worry because your PA200 already has an updated SSD. ... View more

All right so I will now do a deep dive into MTU/MSS troubleshooting. It remains a little strange to me (probably because of not enough knowledge about MTU/MSS), but for 1.5 month there where absolutely no complaints from the customer about connection problems. This one download, actually one website where different downloads where provided, was the only problem. Even this troubleshooting took a while because I wasn't thinking at all that it could be related to this (also because everything else was working). Because of no threat logs and no other blocked connections, I did the next test with disabling various settings in the zone protection profile up to disable the zone protection completely. Without success. So the next step was a "flow basic" debugging where I have seen in the counters that there where ctd_exceed_quque drops. Then the situation was pretty clear why the download was failing. So thanks @reaper for pointing me to the right direction for the next steps in the troubleshooting process ... View more

In this case I would not recommend doing that. Create the rule either only application based as @TranceforLife proposed or limit it by using a custom URL category.   But because Microsoft distributes the updates with a CDN you will most likely end up with often changing your security policy (adding new ip's regularly; deleting old ones; and not to forget to troubleshoot everytime to find out which ip really belongs to this FQDN's and which ones are just traffic you don't want to allow) ... View more

You could use a custom URL category where you enter the fqdn's which you now have configured as address objects. After that remove all the address objects from your security policy and add the custom URL category to this rule. (no URL filtering license required) This way it should be able to limit the access to only the Microsoft Update Servers while not having problems with FQDN objects (where it is, specially with CDN's,  likely that the firewall does not resolve the FQDN to the same ip as your internal server) ... View more

Hi @BrianRa Probably you already found a solution, but a possibility would be the way I am describing here: https://live.paloaltonetworks.com/t5/General-Topics/Global-Protect-quot-Single-Sign-on-quot-with-Windows-Hello-on/m-p/157569#M51667 As written in the post I am not 100 percent sure about possible security problems, but you probably don' t have problems with 3rd party credential providers anymore. Regards Remo ... View more

Thanls @Raido_Rattameister So traffic should pass normally ... simply no logs ... and the restriction to ~1200 concurrent sessions (at least thats what the dashboard shows as max) ... View more