About PavelK

Hello @zaidshaikh   thanks for post!   Panorama has 3 different types of dynamic updates. The details are described in this KB: What are the different Dynamic Updates configurations in Panorama?. To resolve the issue with Panorama itself being behind with latest content updates, configure the option No.1. To resolve the issue where air gapped Firewalls do not have access to download content updates, configure the option No.3. If your Firewalls do not have latest content update installed you might eventually run into an issue that configuration push might fail because of missing application or application dependency.   Ideally, you should keep both Panorama and Firewalls up to date with latest content updates.   Kind Regards Pavel  ... View more

Hello @E.BouRached   thanks for posting!   Could you please share details of error you are getting?   Kind Regards Pavel ... View more

Hello @M.Allen   thanks for post!   Firewall can be member of only a single Device Group. Based on screen shots you provided your old Firewall has 2 vsys (virtual systems) each assigned to separate Device Group. If you want to replicate the same setting with new Firewalls, you will have to enable vsys function in Firewall, then create new vsys. After this you should be able assign each vsys to corresponding Device Group.   Kind Regards Pavel   ... View more

Hello @Metgatz   I am sorry for very late response.   Unfortunately, I do not have much to share. In our environment ASAs are sending SNMP traps for user logon/logoff to User-ID server:   logging list eventlist_user_login_logout message 746013 logging list eventlist_user_login_logout message 746012 snmp-server enable traps syslog snmp-server host management <user-id server> community ***** version 2c   then kiwi syslog (running on User-ID agent server) picks snmp trap up, archives it for auditing, then forwards it to User-ID agent's port.   Kind Regards Pavel   ... View more

Hello @amkolev   I am sorry for late response.   Similar posts for Firewall migration leveraging Panorama came up in the past. Could you have a look? https://live.paloaltonetworks.com/t5/panorama-discussions/palo-alto-5020-migrate-to-5220-from-panorama/td-p/487516 https://live.paloaltonetworks.com/t5/general-topics/pa-3020-to-pa-460-migration/td-p/516049   In nutshell, I would in your case place the new Firewall in the same Device Group as old Firewall. For Template Stack, I would clone old Firewall Template and adjusted new Firewall specific configuration in a new Template.   Kind Regards Pavel ... View more

Hello @TomYoung   I am sorry for late response. I do not recall memory to do anything special. Once the response page was pushed it took precedence over the predefined one. Unfortunately, I only used response page for URL filtering. I do not have any experience with GP Welcome Page.   Kind Regards Pavel ... View more

Hello @RHuss1   only to update you. From PAN-OS 11.1 and later Hostname has been added as a templet variable: configure-template-or-template-stack-variables.   Kind Regards Pavel  ... View more

Hello @vishalrsshah   thank you for reply.   This is something that can be done with Template variables. The Hostname in Template Variable has been added in PAN-OS 11.1. Below are references: new-template-variables configure-template-or-template-stack-variables   If you are not running Panorama on PAN-OS 11.1, then the only option left is to configure hostnames locally or use different Template Stacks for each Firewall.   Kind Regards Pavel     ... View more

Hello @ParticularNoobie   I am sorry to chime in.   Based on my past experience, Mist does not send username unless Radius accounting is enabled under: Site > Wireless > WLANs > [SSID name] > RADIUS Authentication Servers. Reference: https://www.juniper.net/documentation/us/en/software/mist/mist-wireless/topics/topic-map/radius-attributes.html.   Kind Regards Pavel   ... View more

Hello @vishalrsshah   thank you for reply.   Since I do not know what configuration is included in each of the Template, I am not able to answer whether you can remove them and what the impact would be.   If the configuration in Global Settings Template is the same/overlapping with PA-FW01, PA-FW02, PAFW03, PAFW04, then it is safe to remove them as Template at the top of the Stack has the highest priority in the presence of overlapping config. In this case there will be no impact.   If the configuration in PA-FW01, PA-FW02, PAFW03, PAFW04 has different / non-overlapping configuration, then deleting these Templates and committing it to Firewalls will have an impact to remove configuration.   To remove the Templates, you should first remove it from Template stack, then you can delete Template itself.   Kind Regards Pavel         ... View more

Hello @KSamir   thanks for posting!   Based on what you described you might be hitting an issue described in this thread: https://live.paloaltonetworks.com/t5/next-generation-firewall/permitted-ip-address-for-management-interface-could-not-access/td-p/514975. For time being I would recover GUI access by CLI and check the KB mentioned in the above thread before attempting to put permit IP list again.   Kind Regards Pavel ... View more

Hello @vishalrsshah   thanks for post!   Based on what you described you are removing 2 Templates from Template Stack leaving Template Stack empty. Template Stack is a unit that holds Template configuration and assigns it to Firewalls. After you remove both Templates and commit / push that configuration to Firewalls you will be removing Panorama pushed configuration. This will be effectively rollback to local configuration.   Do you have more context what client intends to do?   Kind Regards Pavel  ... View more

Hello @AnupamGaur_Nomios   thank you for reply.   - If you do not see any details in authd.log, could you make sure that debugging is on by issuing this command from CLI: debug authentication show. If debugging is active, you should see "authd debug level: debug". - Can you see any log under: Monitor > Logs > System. Use filter: ( subtype eq 'auth' ). - Could you try to restart authentication process: debug software restart process authd.   Kind Regards Pavel ... View more

Hello @AnupamGaur_Nomios   could you check logs from CLI: less mp-log authd.log to see more details? Have you attached radius authentication profile under: Device > Setup > Authentication Settings > Authentication Profile?   Kind Regards Pavel  ... View more