About Metgatz

Hello @Schneur_Feldman , it all depends on how you adjust it. Some people prefer, once a new release comes out, well a new Update Dynamic, to wait before installing, to review and analyze, relying on the threshold set. There are those who prefer to just download and install every 30 minutes and not leave anything in the threshold. It all depends on your environments and scenarios. Check these links related to Best Practices, but the choice should always be based on your choice, priority and environment:   -https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/software-and-content-updates/best-practices-for-app-and-threat-content-updates Best regards ... View more

Hello @Schneur_Feldman    Hello, good afternoon.   The Threshold corresponds to the additional time. Example you have set every 30, but if you have 48 hrs, after 30 minutes, it will wait the hours you entered in Threshold in your case, example 48, to just perform the action you indicated, as in this case, download and install.   Best regards ... View more

A Ok ok, and try to restart the especific process:   debug software restart process configd   Or, if you can, reboot Panorama. Pan OS 9.1.X ? or 10.0.X or 10.1.X ? If is PAN 10.0 or 10.1 restart debug software restart process device-server   Cheers ... View more

Hello @jchciazacarrion    Good afternoon, of course you can. First you must register your Firewalls in the Support Portal. You must register your equipment, after that, from your firewalls, with Internet Access, apply the retrieve option to automatically download your licenses. Make sure you set the IP parameters in the MGT of your firewalls, and the DNS server, to resolve correctly to the Internet.   You can also, once the firewalls are registered, download the licenses manually and then upload them to the firewalls manually.   It starts counting the time of the licenses, the first time, when the firewalls are registered.   Best regards ... View more

Hello @jwise    I recently fix same issue in 9.1.X.   First yo need to use a Certificate custom ( Self Signed or issue from a internal C.A ). Then create SSL/TLS profile minimoum TLS 1.2, maximium Max.   Now from CLI you need to disable the weka algortims using in the SSL/TLS profile:   Like this:   Disable 3des • #set shared ssl-tls-service-profile TLSprofileTest protocol-settings enc-algo-3des no • Disable SHA1: • #set shared ssl-tls-service-profile TLSprofileTest protocol-settings auth-algo-sha1 no disable RC4: • #set ssl-tls-service-profile TLSprofileTestprotocol-settings enc-algo-rc4 no   Then you need yo assing the TLS Profile to Managment Web-Gui, en Devece-Setup.   Now for SSH you need to do it this: • # set deviceconfig system ssh ciphers mgmt aes256-ctr • # set deviceconfig system ssh ciphers mgmt aes256-gcm • # set deviceconfig system ssh default-hostkey mgmt key-type ECDSA 256 • # set deviceconfig system ssh regenerate-hostkeys mgmt key-type ECDSA key-length 256 • # set deviceconfig system ssh session-rekey mgmt interval 3600 • # set deviceconfig system ssh mac mgmt hmac-sha2-256 • # set deviceconfig system ssh mac mgmt hmac-sha2-512 • # delete deviceconfig system ssh kex mgmt • # set deviceconfig system ssh kex mgmt ecdh-sha2-nistp521 • # commit Then restart the service SSH: # set ssh service restart   Important: Always as a good practice, generate a Backup of your config.   Best regards ... View more