About GabrielMontiel

GabrielMontiel · ‎05-14-2023

Update: i updated to 10.2.3 from 10.1.9 and the commit its now working but the peer bgp status is not established since the local id is 0.0.0.0 (from runtime stats) Any help someone?

GabrielMontiel · ‎05-13-2023

I know it should be possible Thats why i opened this thread i get a routed error "You have to specify an ip address because the interface has more than one" Maybe it is a bug?

GabrielMontiel · ‎05-06-2023

Is it possible to configure BGP on a panorama template with the bgp local address on a dhcp interface without specifying the address? since if i have to specify the address the configuration would not be viable

GabrielMontiel · ‎02-14-2023

Replying to the first question, yes you need to deploy the panorama first. Second question, if Zone 1 and 2 Fails at the same time, your firewalls will be down no matter if you have standalone vm-series or a scale set. Because standalone virtual machines also reside in a Zone, its not like you have better availability having a virtual machine. I would recommend scaleset + load balancer 99% of the time

GabrielMontiel · ‎02-10-2023

Do you have appliance mode enabled on the attachment thats connected to the firewalls VPC? Also based on your previous reply, you would need to do a NAT destined to internet addresses so the replies passes trough the palo alto, either a NAT or you could create a route(Private addresses or VPC B) from the NAT gateway to reply back to the palo alto.

GabrielMontiel · ‎02-10-2023

If the ARM template has bootstrapping parameters that makes them connect to Panorama, and you have the panorama configuration outside even if you had a Panorama Outage + VM series outage you could redeploy with Only the ARM template and deploying a new panorama, You can make the panorama automatically push the config if the devices have dg and template configured in the boostrapping I would highly recommend to you to look into vm-series scale set in azure, so that if you have an outage the scale set deploys automagically another device without any intervention of you.

GabrielMontiel · ‎02-09-2023

Do an operational command: https://pan-os-python.readthedocs.io/en/latest/getting-started.html#operational-commands Execute this command: show arp ethernet1/24.335 https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClpnCAC

GabrielMontiel · ‎02-09-2023

You could report the false positive for palo alto url categorization on: https://urlfiltering.paloaltonetworks.com/ But if you want it to be removed from virustotal, https://support.virustotal.com/hc/en-us/articles/115002121185-I-am-experiencing-a-false-positive-my-file-or-site-should-not-be-detected- as per their page: " I am experiencing a false positive, my file or site should not be detected. VirusTotal simply aggregates the output of different antivirus vendors and URL scanners, it does not produce any verdicts of its own. As such, if you are experiencing a false positive issue, you should notify the problem to the company producing the erroneous detection, they are the only ones that can fix the issue. Please note that even if we were able to remove the flag, the users of such product would still be blocked from accessing your site. Please find the company on our contributors page and reach out to them. "

GabrielMontiel · ‎02-07-2023

What you are asking is to basically root the panorama 😂 I dont think palo alto supports it officially.

GabrielMontiel · ‎02-07-2023

Even though the firewalls have the panorama IP from the template, you once had to insert it manually before the firewall was managed by panorama. so my suggestion would be launch the new panorama with the new ip, migrate the config to the new panorama (new ip) and just change the IP in the template config (from the old panorama ip and do a push) they will connect to the new one, and since it has the same config, no problem. New ones insert it manually just like you did before.

GabrielMontiel · ‎02-07-2023

Yes, you can read the documentation about predefined reports (log summary): https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-panorama-api/pan-os-xml-api-request-types/get-reports-api And about log exporting (in detail): https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-panorama-api/pan-os-xml-api-request-types/retrieve-logs-api

GabrielMontiel · ‎01-18-2023

Oh now i get you, best way to do this imo, is filter by the policy name on monitor, extract CSV columns ( you can extend the amount of rows you can export in device/panorama, on the setup page https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClaPCAS ) And then start filtering with excel, and create the new policies above the current general one, you can repeat this process until you have no new hits on the old policy.

GabrielMontiel · ‎01-17-2023

Im not quite sure what you mean with "server to server" if by that you mean a single IP address, or a CIDR address range, you can see new applications or the applications used within a single security policy rule, with that you can separate each server flow with security policies and with the policy optimizer in security policy GUI page theres a column named "apps seen" you can click on that number and see which applications have done a match with that security policy

GabrielMontiel · ‎01-16-2023

I understood your use case, yes policy optimizer is mostly to use applications in policies. If you want to "close" the policy to some src and dst addresses it would be easier for you to create a custom report filtering with the policy name, or simply in the ACC filter to policy name, also you could extract palo alto logs in csv format and do some excel dynamic table magic its a button on top right in the monitor traffic logs

GabrielMontiel · ‎01-13-2023

Dont need to do that! Thankfully palo alto has already a tool INTEGRATED into the firewall, you can see it at the left bottom corner its called policy optimizer, which does exactly that what you are asking for, but without running trough so many hops, https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/app-id/security-policy-rule-optimization/migrate-port-based-to-app-id-based-security-policy-rules Also i would suggest you to read and watch some tutorials on the expedition tool, which helps your migrations from old FW to NGFW from palo alto networks, https://www.paloaltonetworks.com/products/secure-the-network/next-generation-firewall/migration-tool I hope this information suits you well!

Member Since	‎06-21-2021 08:18 AM
Date Last Visited	‎04-10-2024 11:46 PM
Posts	30
Total Likes Received	9

Online Status	Offline
Date Last Visited	‎04-10-2024 11:46 PM

About GabrielMontiel

Re: BGP on a dhcp interface, on a palo alto

Re: BGP on a dhcp interface, on a palo alto

BGP on a dhcp interface, on a palo alto

Re: How to schedule a backup of the Device State for VM-Series Firewalls ( managed by Panorama ) Azure.

Re: Paloalto VM Series VPC Peering support on AWS

Re: How to schedule a backup of the Device State for VM-Series Firewalls ( managed by Panorama ) Azure.

Re: pan-os-python - how to view Static ARP mappings within a Layer3Subinterface?

Re: VirusTotal False Positive: ccml.io domain

Re: Panorama appliance question

Re: Migrate Panorama to AWS

Re: Terraform for Panorama Configuration management

Re: How to schedule a backup of the Device State for VM-Series Firewalls ( managed by Panorama ) Azure.

Re: How to schedule a backup of the Device State for VM-Series Firewalls ( managed by Panorama ) Azure.

Re: Complete application traffic report for firewall rule

Import Existing Security Policies from Panorama to Terraform code (Reverse Terraform for Palo Alto)

Re: CPU for VM Panorama

Re: BGP on a dhcp interface, on a palo alto

Re: BGP on a dhcp interface, on a palo alto

BGP on a dhcp interface, on a palo alto

Re: How to schedule a backup of the Device State for VM-Series Firewalls ( managed by Panorama ) Azure.

Re: Paloalto VM Series VPC Peering support on AWS

Re: How to schedule a backup of the Device State for VM-Series Firewalls ( managed by Panorama ) Azure.

Re: pan-os-python - how to view Static ARP mappings within a Layer3Subinterface?

Re: VirusTotal False Positive: ccml.io domain

Re: Panorama appliance question

Re: Migrate Panorama to AWS

Re: Question about System Logs

Re: Complete application traffic report for firewall rule

Re: Complete application traffic report for firewall rule

Re: Complete application traffic report for firewall rule

Re: Complete application traffic report for firewall rule

Unlock your full community experience!

About GabrielMontiel