About bschaper

I will have to confirm that Panorama is still sending telemetry, the changes were made in panorama to add logging to the rules and pushed to all the firewalls impacted.   ... View more

lol, I double checked, but yes.  The upgrade from 10.1.5-h1 would not proceed without all the plugins downloaded. I have 3.0.1 installed.    if I do "tail plugins-log plugin_sd_wan.log " I get the following, doesn't mean much to me.   2022-05-20 16:32:05.400 -0700 INFO: Not fetching template-stacks since there are no dirty devices 2022-05-20 16:32:09.814 -0700 INFO: sd_wan plugin validation: successfully completed validation of pre 9.1.0 device 2022-05-20 16:32:09.820 -0700 INFO: commit validate disk_ok check passed. 2022-05-20 16:32:18.520 -0700 INFO: ---creating cluster map instance--- 2022-05-20 16:32:18.523 -0700 INFO: ---move old plugin information--- 2022-05-20 16:32:18.524 -0700 INFO: ---parsing configuration--- 2022-05-20 16:32:18.524 -0700 INFO: cluster gen: Getting .candidate config 2022-05-20 16:32:18.526 -0700 ERROR: Could not load template stack config. Exiting... 2022-05-20 16:32:20.778 -0700 DEBUG: No inline result files for SDWAN 2022-05-20 16:32:20.778 -0700 DEBUG: No updates to process ... View more

Also, this is not on panorama itself, but two an FTP server. But for example our Cisco call manager exports to an external server as well, but manages how many backups it has saved and clean them off as they age out ... View more

We run 10.1.2 ... View more

Have you tried this with a SD-WAN configuration?  The plug-in in Panorama has part of the configuration, and the device needs to be added there as well, along with deploying the sdwan plugin. I am afraid future commits will just break it.  ... View more

Thanks, our clients still point to the dc, that is an easy change. Our firewalls point the domain to the internal and everything to the isp. The forwarders would be the question. But You are correct in saying that having the clients utilizing the firewall is probably most critical.  ... View more

Thanks Jason, that is exactly what I am seeing sinkhole addresses all originate from the DC and the logging seems spotty. I could certainly point the clients on the same subnet to the proxy, but it has me wondering about the DC itself for external name resolution.  ... View more

Hi Mick, here is the diagram.  The site uses SDWAN and connects to a PA-3220 at the data center.  The PANOS Version is 10.0.2.  Now the switch does not have IP helper on it, but it does not have routing services either.  All of this worked fine until recently and does not seem to correlate to a PANOS version either.  I am at a loss as to why rebooting the switch would work and removing the relay and re-adding works as well.  It has worked fine for years, until the last couple months.  The packet capture was from the workstation, but the plan next time is run it from the firewall as well. ... View more

Sorry to hear you are having such problems. We deployed about a year ago and I do recall some similar problems, the dependence on panorama connectivity and kind of chicken and the egg problem seems to break the script.  I will be curious if you get this to work. We run 10.0.3, but I can’t get a higher version of Panos to work. The sdwan interface stays down/init.  ... View more