About PavelK

Hello @Warron_F    although I do not know what content was in the original link, this KB: Allowing Specific IP Addresses to Access the Palo Alto Network Device looks like having the same name and likely content as well.   Kind Regards Pavel ... View more

Hello @S.Hillcenter   you can install locally in your PC SCP or TFTP server and upload the TSF file directly to your PC, then attach it to the TAC ticket. Here is a reference: How to Collect Tech Support File from a Log Collector. The KB is for log collector, but you can use the same commands for Firewalls as well. In the past when I had to get TSF from log collector, I recall memory to use WinSCP client on Windows machine that worked well.   Regarding direct upload to support portal, could you refer to this KB: How to Generate and Upload a Tech Support File Using the WebGUI and CLI? The <The TAC case number>@tacupload.paloaltonetworks.com:./ should match including leading zeros.   Kind Regards Pavel ... View more

Hello @soc_mlopez   thanks for post!   If you would like to route traffic through both VPN tunnels at the same time, you will have to enable ECMP and use routing protocol (For example OSPF) to advertise prefixes equally across both tunnel interfaces. Details of this setup are described in this KB: OSPF over IPSec with load balancing via ECMP dual ISP.   More advanced option of the above setup would be to use OSPF to advertise Loopback interface IP address across both tunnels and then establish BGP between loopback IP addresses of both Firewalls. In this case OSPF would serve as a transport to advertise Loopback IP address over which BGP establishes session that will be used to route traffic across both tunnels. If one of the tunnel goes down or ISP link is flapping (up/down/up event), the BGP session still remains up.   Based on information in your post it looks like you do not have any dynamic routine in place which might cause extra complexity, however by using dynamic routing you can utilize both tunnels at the same time without avoiding asymmetric routing. With static route path monitoring you will likely still be running vpn tunnel routing in active / standby scenario with failover option when path monitoring fails. If path monitoring is not setup properly on the other side of the tunnel you might be blackholing traffic or causing asymmetric routing.   Kind Regards Pavel ... View more

Hello @sredwards   thanks for post.   You can track progress of signature creation status from: threatvault. As of now, it is reporting below status:    Kind Regards Pavel ... View more

Hello @boyuzhan   PAN-OS 12.1 is covered in the section: "11.1 & Later": Panorama Plugin for Cisco TrustSec Configure the Panorama Plugin for Cisco TrustSec   Kind Regards Pavel   ... View more

Hello @P.Singh699426   thank you for reply.   What PAN-OS version did you upgrade to? I went through release notes of PAN-OS 11.1.11 and unfortunately there is no addressed issue corresponding to symptoms you described.   Kind Regards Pavel  ... View more

Hello @SeanDeHarris   as of now custom reports are not supported in SCM. The closest official statement I could find is in this KB: Is it possible to create custom report to aggregate destination ports on Prisma access cloud manager.   Kind Regards Pavel  ... View more

Hello @P.Singh699426   thank you for reply.   I was going through documentation and based on what I could get out of this page: Local Authentication this looks like expected: If possible, could you in authentication profile set type to: "Local Database"?   Kind Regards Pavel ... View more

Hello @LeifAlire @JustinWoodman    sorry to step into this discussion.   Similar discussion came up in this post: Advice on dual isp, getting dns to work. In Azure, Traffic Manager can be used for health check + failover of VPN portals. Although, I do not have real world experience with the same deployment in AWS, Route 53 can serve the same purpose.   Kind Regards Pavel   ... View more

Hello @P.Singh699426   thanks for post!   Based on release notes there is no known issue corresponding to your post. Could you please run from CLI: tail follow yes mp-log authd.log while logging with that account to see it can provide more details?   Kind Regards Pavel ... View more

Hello @zaidshaikh   thanks for post.   Based on documentation: What Doesn't Sync in Active/Passive HA? most of the certificates and certificate related configuration does not sync in HA deployment. It specifically does not call out a certificate used for VPN, however personally I believe it is a root cause. I would add the certificate to the Template associated with FW02.   Kind Regards Pavel ... View more

Hello @H.Pakdaman   in below links you will find a complete list of all syslog messages:   Informational System Log Messages Low Severity System Log Messages Medium System Log Messages High System Log Messages Critical System Log Messages   All VPN events you mentioned in your post fall into informational severity under vpn section. The BGP event you mentioned in your post falls into high severity under routing section.   Unfortunately, the description of the events is brief without going into too much details.   If you are troubleshooting VPN related issue perhaps this KB: How to troubleshoot IPSec VPN Tunnel Down can help.   Kind Regards Pavel ... View more