About PavelK

Hello @DavidSink   thank you for reply.   The message you got looks like expected. I checked the same in multiple Firewalls that are sending logs without any issue and got the same output.   - Could you try to restart management process: How to Restart the Management server "mgmtsrvr" Process? - Are you using any log forwarding filter under: Object > Log Forwarding > [Profile Name] > Log Type Threat > Filter?   Kind Regards Pavel      ... View more

Hello @mitchduf   thanks for post!   You can find that information in product comparison page: Product comparison. Filter it out for Firewall model you want to find details for.   Kind Regards Pavel  ... View more

Hello @amkolev   thanks for post!   To be honest I do not think there is any difference in procedure between Firewall mentioned in this post and latest Firewalls. Some miner differences might come from features introduced in latest versions of PAN-OS.   Would you mind provide more details what your scenario / migration is?   Kind Regards Pavel    ... View more

Hello @Jameslee20   thank you for reply.   The filter ( subtype eq 'scan' ) is a Threat type filter that will display all types of scanning events. Since nothing shows up in logs in your case, could you confirm below points:   - Did you enable "Log Setting" under zone where zone protection is enabled? Please refer to this KB: Difference between Log Forwarding for a Zone and Security Policy Log Forwarding (Scroll down to section "Zone Log Forwarding"). - Could you review this KB: Zone Protection Profile Not Generating Logs During Penetration Scan? There are no threat logs if there is "deny" action in security policy. - Could you review this KB: How to investigate "SCAN: TCP Port Scan" alerts? The scanning event will be generated only when scan exceeds the Threshold (Events) within the Interval (Sec) defined in the Zone Protection profile applied to the ingress Zone for TCP Port Scan. - Could you make sure that traffic you are investigating is not included in the exception list (source address exclusion)?   Kind Regards Pavel    ... View more

Hello @DavidSink   thanks for posting!   PAN-OS 10.0 you are running is end of life. I would recommend to follow upgrade path to at least 10.1: Determine the Upgrade Path to PAN-OS 10.1 or newer.   There is no special configuration for threat logs. Could you confirm you can see logs locally in Firewall? Could you check point No.4 of this KB: How to troubleshoot firewall or Panorama log queue issues? Could you also try restarting logging service: "debug software restart log-receiver"?   Kind Regards Pavel  ... View more

At this moment there is no app-id for Surfshark to block this traffic based on application. To request this app-id to be added you can follow this KB: How to Request a new App-ID.   Kind Regards Pavel    ... View more

Hello @Khairul.Nizam   thanks for post.   Similar questions came up in this forum in the past. Would you mind checking below posts? Some of them are almost identical to what your scenario is.   https://live.paloaltonetworks.com/t5/general-topics/pa-3020-to-pa-460-migration/td-p/516049 https://live.paloaltonetworks.com/t5/panorama-discussions/syntax-for-pa3050-and-pa3020/td-p/527512 https://live.paloaltonetworks.com/t5/general-topics/how-to-migrate-of-existing-config-rules-from-pa-3020-in-a-ha/td-p/459796 https://live.paloaltonetworks.com/t5/general-topics/how-to-replace-a-managed-device-pa-3020-with-a-new-device-pa-850/td-p/171028 https://live.paloaltonetworks.com/t5/panorama-discussions/palo-alto-5020-migrate-to-5220-from-panorama/td-p/487516   If there is anything else do not hesitate to ask.   Kind Regards Pavel  ... View more

Hello @Jameslee20   thanks for post!   You can use this filter: ( subtype eq 'scan' ) in Threat logs. It includes Host Sweep (ID 8002), TCP Port Scan(ID 8001) and UDP Port Scan (ID 8003).   Kind Regards Pavel ... View more

Hello @C.Stuart   thank you for reply.   I can see below addressed issue in PAN-OS 11.1.4:   PAN-244746 Fixed an issue where changes committed on Panorama were not reflected on the firewall after a successful push.   Also, there is another addressed issue in PAN-OS 11.1.5, however since you are able to push certificates and able to apply them through profile it might not be related:   PAN-251035 Fixed an issue where selective push operations did not push certificate changes to the firewall.   If you decide to upgrade Panorama, I would recommend to go straight to 11.1.5 to avoid the upgrade issue discussed in this thread: Unable to upgrade Panorama to 11.1.4-H1.   Kind Regards Pavel  ... View more

Hello @C.Stuart   thank you for reply.   Could you please confirm PAN-OS version running on Panorama and on Firewall? I came across known issues in some versions where Panorama pushed configuration was not applied in Firewall.   Kind Regards Pavel  ... View more

Hello @rlcope   to upgrade from 10.2.11-H3, you do not have to install 10.2.0 base image. You can directly upgrade to your target version 10.2.11-H3. Here is a reference in documentation: Determine the Upgrade Path to PAN-OS 10.2.   Regarding the issue you faced during your last upgrade attempt, could you share error message or describe in detail what happened?   Kind Regards Pavel  ... View more

Hello @thanhlb   thank you for reply.   As a next step I would check Traffic logs to see difference between both VLANs.   Kind Regards Pavel      ... View more

Hello @joet   thank you for reply.   You do not have to worry. With dynamic updates you will not experience any reboot nor disruption. It is hitless process. To retrieve latest updates, click on "Check Now", then install latest "Application and Threats" content update to resolve the issue preventing the PAN-OS upgrade. To keep Firewall update up to date set download and install content updates.   Kind Regards Pavel ... View more