About PavelK

Hello @Savan_Vorn   could you please provide more details what your question is?   Kind Regards Pavel ... View more

Hello @PaulSmith89   thanks for post!   The only thing I can think of is to use device group filter in log search. For example: (device-group eq "Name of DG"). Alternatively negation to exclude child device groups. For example: (device-group neq "Name of DG").   Kind Regards Pavel ... View more

Hello @renzanjo11   thank you for reply.   From the output of tcpdump it looks like that syslog traffic is being sent out. Are you able to confirm that your syslog server is receiving traffic? Is there any Firewall / ACL in between?   Kind Regards Pavel  ... View more

Hello @madu2609   thanks for post!   I have checked ZCC traffic logs in my environment and I can confirm that traffic across all Firewalls is identified correctly as zscaler-internet-access and zscaler-private-access. Regarding your case what comes to my mind is Z-Tunnel 1.0 vs Z-Tunnel 2.0: z-tunnel-1.0-z-tunnel-2.0. If your clients are using Z-Tunnel 1.0, then this could be an reason why Firewall is identifying traffic as proxy. Was there any change in forwarding profile?   Kind Regards Pavel  ... View more

Hello @JuanMAbellan   thanks for post!   To my knowledge the only time Panorama backs up Firewall's configuration is local commit on Firewall that will trigger automatic config backup: Manage Panorama and Firewall Configuration Backups. From the provided information it is hard to determine why there is a certificate error preventing config backup. Would it be possible to check ms.log and configd.log on Panorama from CLI to see it can give more details? Are you using custom certificate for communication with managed Firewall? Are you using the same time zone and time on Panorama as well as Firewall?   Kind Regards Pavel    ... View more

Hello @clewis1   personally, I think especially for larger amount of Firewalls it is better to have each Firewall retrieve dynamic updates directly instead of deploying it through Panorama. I would limit the Panorama deployed updates only to Firewalls that do not have internet access to retrieve updates directly.   Regarding the error you shared in screen shot this looks like a bug documented in this KB: Commit error on Panorama "Too many (30) deploy jobs pending". If you upgrade to version where this defect is addressed, you will likely be able to continue to use Panorama deployed updates.   Kind Regards Pavel  ... View more

Hello @J.Gomez   unfortunately, LIVEcommunity is not able to help with support portal login issue. Could you please contact login assistance by filling up this form: login-assistance.   Kind Regards Pavel  ... View more

Hello @Ismailsh   from what I have seen in other organizations as well as the one I am working for is to set a common time zone regardless of device location. Also, having different time zone set between Firewall and Panorama might cause an issue described in this KB: Device logs are not showing up in the Panorama GUI due to mismatch of the time.   Kind Regards Pavel  ... View more

Hello @K.Mohamed   thank you for reply.   I would configure LACP active on PA as well as Cisco side. I would also recommend to enable the LACP pre-negotiation LACP and LLDP Pre-Negotiation for Active/Passive HA  by selecting check box under: LACP > High Availability Options > Enable in HA Passive State.   Kind Regards Pavel ... View more

Hello @nabin.sutradhar   thanks for post.   This is a broad question and between versions 10.1 and 11.1, there are also versions 10.2 and 11.0. When it comes to new features introduced in each version I would recommend to start looking into below release notes:   Features Introduced in PAN-OS 10.1 Features Introduced in PAN-OS 10.2 Features Introduced in PAN-OS 11.0 Features Introduced in PAN-OS 11.1   Please also note that not every Firewall supports all versions. Here is Palo Alto Networks Compatibility Matrix.   Kind Regards Pavel       ... View more

Hello @mohammedsalhis   thanks for post.   There is no native/built-in way to synchronize an object or policy from a Firewall to Panorama. Even if you over come this with scripting to automate an object creation in Firewall and in Panorama's Device Group at the same time, it is going to have following side effect. After an object is created in Panorama, the Device Group will become out of sync. To resolve the configuration out of sync issue, you will have to push that configuration to Firewall, however you will get an error while pushing configuration as an identical object already exists in Firewall locally. To me the requirement from your customer is not practical. Would you be able to give more context what your customer would like to accomplish?   Kind Regards Pavel  ... View more