About PavelK

Hello @josealonso   I know that this is not completely fulfilling request in your post, but Palo Alto is going to re-categorize "github.com" and "podman.io" from "Shareware and Freeware" to "Computer and Internet Info":     Kind Regards Pavel ... View more

Hello @ademo-user25   thank you for reply.   To me your approach looks good. If you do not mind setting up new Firewall pair with new management interface IP addresses (The rest of the configuration can be identical with original Firewalls), you could save time during cut over on initial tasks like downloading licenses and forming HA.   Also, you might have to clear ARP records in your Layer 3 switches during cut over to new Firewalls. This scenario would come when GARP does not work to update ARP entries with new IP/MAC mapping.   Kind Regards Pavel  ... View more

Hello @colin.dsouza   thanks for posting!   Similar migration posts are coming up here often. I would recommend to upgrade PA-440 to the same PAN-OS version as PA-1410, then export the configuration and import it to PA-1410 (You might have to modify configuration file in the case interfaces do not match resulting commit errors).   Here are a few posts with similar migration topic for reference: https://live.paloaltonetworks.com/t5/general-topics/migrate-from-pa-3050-to-pa-3410/td-p/531128 https://live.paloaltonetworks.com/t5/general-topics/how-to-migrate-of-existing-config-rules-from-pa-3020-in-a-ha/td-p/459796 https://live.paloaltonetworks.com/t5/general-topics/migrating-from-5060-to-5220/td-p/199309 https://live.paloaltonetworks.com/t5/general-topics/pa-220-to-pa-440-migration-recommended-process/td-p/572764 https://live.paloaltonetworks.com/t5/expedition-discussions/migrate-cluster-pa-3020-configs-to-pa-1410/td-p/535486   Kind Regards Pavel   ... View more

Hello @JeanPaul222   I am not sure whether this can help you. There is a feature for admin tracking activity. Could you have a look at this KB: How to configure Audit Tracking for Administrator Activity (Log Admin Activity).   Kind Regards Pavel   ... View more

Hello @sreekanth.gude   as of now Palo Alto Firewalls have native integration with S3 only from Strata Logging Service: Forward Logs to AWS S3 Bucket. To send logs from Firewall to S3 bucket, you will have to send logs first by syslog to server where through different agent / plugin logs will be forwarded to S3 bucket.   Kind Regards Pavel  ... View more

Hello @ademo-user25   thanks for posting!   To form HA both Firewalls must be the same HW models: Prerequisites for Active/Passive HA.   I have done Data Center Firewall migration before with minimal downtime. Could you please refer to this thread: PALO ALTO 5020 migrate to 5220 from Panorama? You can skip points No.1 and 2. Also, if you can include more details about your environment it would make it easier and more accurate to answer you.    Kind Regards Pavel   ... View more

Hello @K.McCloud   could you check this KB: How to Verify SNMP Functionality? Make sure that SNMP service is enabled under management interface. Also, if SNMP community string has special character, there is a known issue: SNMP v2c poll not responding.   Kind Regards Pavel ... View more

Hello @jwill2   thanks for post!   In the official KB and documentation: HA1 interfaces on PA-3400 and PA-5400 series cannot be configured on the management port only PA-3400 and PA-5400 series are mentioned as affected platforms. I do not have PA-1400 Firewall at my disposition to confirm it, however it looks like that PA-1400 has this limitation as well.   Kind Regards Pavel ... View more

Hello @D.Callahan   thanks for post!   To send management traffic over loopback interface instead of management port, you will have to setup service route: Setting a Service Route for Services to Use a Dataplane's Interface from the Web UI and CLI. If your management interface is completely disconnected / unused, please set all services to used loopback interface. If you are planning to use both management interface as well we loopback interface, then you can set only "panorama" for service route. Please note that even though Firewall is registered to Panorama with data plane interface (loopback) in your case, the Firewall registered IP address on Panorama side is still showing management interface: When Firewall's service route is configured with ethernet interface for Panorama, why is Panorama displaying connected to firewall's management interface?.   Make sure that loopback IP address is advertised to over VPN tunnel that Panorama knows how to reach it.   When it comes to securing management traffic Palo Alto has best practice guide: Deploy Administrative Access Best Practices. The best is to have dedicated out of band management network, however if you have only a single VPN tunnel the options are limited.   Kind Regards Pavel    ... View more

Hello @cdcirexx   thank you for reply.   Only slight correction. Traffic Manager is not part of M365, but it is part of Azure. Here is a simple explanation how it works: How Traffic Manager Works. Your external services can be added to Traffic Manager as External Endpoints as either IPv4/IPv6 or FQDN: Traffic Manager endpoints.    Kind Regards Pavel ... View more

Hello @M.Allen   thanks for post!   To me your configuration on both switch side as well as Firewall side looks complete. The only thing, I would considered to add is on Firewall side interface AE3.3501 as OSPF interface type p2p to match setting on switch side: configure-ospf (Point No. 5 in the manual).   Kind Regards Pavel ... View more

Hello @PIRAMAL   Palo Alto has not announced yet EoL for PA-410. The EoL announcement for every model is published in this page: Hardware End-of-Life Dates.   Kind Regards Pavel ... View more