About Remo

Hi @${userLoginName}  Was the commit successful when you configured the IP address and other things? What PAN-OS version is installed on that box? Maybe a dumb question, but did you try to reboot the box already? ... View more

Hi @dotorg  Actually this is not possible. If an admin has superuser permission then it is possible to change anything. If you really want to achieve that all configuration is done in panorama you need to block the admins on the firewall/context switch - or allow only a very limited number of admins to do so and they need to be trained to only use panorama for the configuration. If this is not sufficient, you could contact your system engineer from paloalto to create a feature request for this. ... View more

Hi @cuahanghoatuoi9x  Maybe you need to specify with more information. Right now this does not sound like a job for paloalto. I think you are searching for an MDM solution. With paloalto firewalls you will be able to block specific traffic so the already installed app will not be able to communicate but thats about it. ... View more

I had the same issue on panorama. @Ben-Price did you open a TAC case to report the bug? ... View more

Hi @S_Owoc  Could you share some screenshots or config snippets of the rules and also screenshots from the URL and/or Traffic Log of that connection? Actually I do not really agree with TAC - maybe there was a misunderstanding - but there definately is a way to check why it hit rule 1. ... View more

Yes, I read the article, that version 2 will be released in 2022 (I know the meaning of the word 'beta' ; ) But I did not assume that not 'completely developed' means not working at all. And I still think this is a general problem in the repository on conversionupdates.paloaltonetworks.com because - as I also wrote some posts ago - version 1 fails also comoletely --> installation is not possible currently. ... View more

Hi @lychiang  This is what I get when I run the beta script on the ubuntu 18.04 server:   ************************************************************ Installing Expedition packages ************************************************************ Installing Expedition packages --2021-08-26 23:31:57-- https://conversionupdates.paloaltonetworks.com/ex-repo.gpg Resolving conversionupdates.paloaltonetworks.com (conversionupdates.paloaltonetworks.com)... 199.167.52.71 Connecting to conversionupdates.paloaltonetworks.com (conversionupdates.paloaltonetworks.com)|199.167.52.71|:443... connected. HTTP request sent, awaiting response... 404 Not Found 2021-08-26 23:31:58 ERROR 404: Not Found. spawn apt-get install -y --allow-unauthenticated expedition2-beta Reading package lists... Done Building dependency tree Reading state information... Done E: Unable to locate package expedition2-beta spawn apt-get install -y --allow-unauthenticated expedition2-converter-beta Reading package lists... Done Building dependency tree Reading state information... Done E: Unable to locate package expedition2-converter-beta chown: cannot access '/var/expedition-converter/': No such file or directory chown: cannot access '/var/www/html/expedition-api/': No such file or directory Updating databases ./initSetup2beta.sh: line 253: /var/www/html/expedition-api/database/SQL/pandb.sql: No such file or directory ./initSetup2beta.sh: line 254: /var/www/html/expedition-api/database/SQL/pandbRBAC.sql: No such file or directory ./initSetup2beta.sh: line 255: /var/www/html/expedition-api/database/SQL/BestPractices.sql: No such file or directory ./initSetup2beta.sh: line 256: /var/www/html/expedition-api/database/SQL/RealTimeUpdates.sql: No such file or directory Tunning some Expedition parameters cp: cannot stat '/var/www/html/expedition-api/initSetup/apache2/default-ssl.conf': No such file or directory Installing Spark dependencies Reading package lists... Building dependency tree... Reading state information... openjdk-8-jre-headless is already the newest version (8u292-b10-0ubuntu1~18.04). 0 upgraded, 0 newly installed, 0 to remove and 5 not upgraded. Reading package lists... Building dependency tree... Reading state information... E: Unable to locate package expeditionml-dependencies-beta mysql: [Warning] Using a password on the command line interface can be insecure. ERROR 1146 (42S02) at line 1: Table 'pandbRBAC.ml_settings' doesn't exist ... and I am not able to access the GUI. There is only an ssl protocol error shown in chrome. ... View more

Hi @lychiang  Let me summarize again what I did. I first set up a new ubuntu 18.04 server where I tried to installe the expedition beta --> installation failed because of missing ressources on conversionupdates.paloaltonetworks.com Then I installed another server. This time ubuntu 16.04 where I tried to install the stable version-->  installation script fails because of the same reason. (The servers had internet access and there is no GP involved)   ... View more

Hi all I am no longer talking about the beta script. I saw that the current stable release also tries to download some of the same files including https://conversionupdates.paloaltonetworks.com/ex-repo.gpg which is not available. So at the moment it is not possible to install the stable or the beta version. ... View more

Hi @lychiang  I read this. Actually I am talking about the beta init setup script. ... View more

Hi @Marc.Luecke  Does this problem happen often/constantly? Even if your TSA version is still supported  I would try it with one of the current version (directly version 10.1). ... View more

I guess as this feature is available also on the cheapest switches (implemented in hardware), the focus of paloalto wasn't on something like this. ... View more

Hi @Amin2  Generally Prisma means a cloudservice by Paloalto. So in this case here Prisma SD-WAN is the SD-WAN technology (formerly Cloudgenix which was aquired by Paloaltonetworks) based on ION devices. These devices are configured with a cloudservice from Paloalto. To these devices you can connect various WAN links like MPLS, LTE and so on. By policies configured in the cloud the best path will be chosen for specific traffic to be sent to your main datacenter where you need an ION-7000 or ION-9000. These ION devices are only for the SD-WAN part. They also analyze traffic to forward it to the right configured path but these are not actual firewalls. Paloalto SD-WAN is SD-WAN for Paloalto firewalls. So in addition to the best in class network security that you get with a Paloaltonetworks firewall, this subscription also enables the SD-WAN technology where you can add different WAN links to the firewall and configure them to be used all at the same time for different types of traffic including the dynamic setup of VPN tunnels (like with the ION devices) between your locations. The configuration of the Paloalto SD-WAN is not done locally on the firewalls or with panorama and not with the cloudservice. ... View more