About PavelK

Thank you for reply @SamerQ   the login credentials for: https://beacon.paloaltonetworks.com are the same as for LIVEcommunity. You will find SD-WAN course directly on home page under: "What's New".   Kind Regards Pavel ... View more

Sorry to step in, the requirement for n/2 + 1 was introduced with PAN-OS 10 and later:   https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-release-notes/pan-os-10-0-release-information/changes-to-default-behavior The behavior with one faulty log collector is therefore expected.   Kind Regards Pavel ... View more

Hello @SamerQ   there is one course in Beacon: https://beacon.paloaltonetworks.com/student/collection/660386-prisma-sd-wan?sid=5de7a03f-3037-4826-b1f3-e81b1e1621bb&sid_i=0 for Prisma SD-WAN.   Kind Regards Pavel ... View more

Hello @BigPalo   could you check System logs under: Monitor > Logs > System ? You can use this filter to get only logs for job failure: ( description contains 'job failed' ).   I have seen this error before when Panorama was configured to deploy updates to managed Firewall and this was failing. Could you confirm whether you are using deployment of updates. You can find this configuration under: Panorama > Device Deployment > Dynamic Updates > Schedules.   Kind Regards Pavel ... View more

Hello @JeromeC   this connection design is functional. Cisco switches in stack act like a single switch, so on switch side it is cross stack ether channel and Palo Alto Firewall will see its AE as if it is connected to a single switch.   Kind Regards Pavel   ... View more

Hello @vsingh31   you can see decryption policy name from decryption log under: Monitor > Logs > Decryption. Make sure that column: "Policy Name" is added in the view. Below is a reference in documentation: https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/decryption/troubleshoot-and-monitor-decryption/decryption-logs   Kind Regards Pavel ... View more

Hello @Tobi_Babatunde   we have deployed PA-850 in A/A HA by using 2x regular data plane ethernet interfaces in AE for HA3. It is working fine in terms of stability and performance. I do not see any reason not do the same for PA-220. Based on documentation, using AE for PA-220 is recommended: https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-web-interface-help/network/network-interfaces/aggregate-ethernet-ae-interface-group   You still have to enable jumbo frames.   Kind Regards Pavel ... View more

Thank you for reply @Habte-01   I am running out of ideas. Could you please confirm what PAN-OS are you running? I would like to see I can re-produce it by using the same version.   Kind Regards Pavel ... View more

Thank you for reply @alan-griffiths   based on the output you provided there is a connection issue. The connection status is "inactive".   Could you please confirm the status of the Firewall in Panorama under: Panorama > Managed Devices > Summary. If the status is not connected, could you go through this KB: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClaWCAS   If anything in the above KB provides solution, could you check on Firewall side from CLI logs: tail lines 500 mp-log ms.log   Kind Regards Pavel ... View more

Hello @alan-griffiths   since it is a new installation it could be anything at this stage. To isolate issue to either Firewall or Panorama side, could you please run below commands and share the output:   Firewall: show log-collector preference-list show logging-status   Panorama: show logging-status device <serial number of Firewall>   Depending on the output from the above commands, I would set next course of action, however on general note make sure that Firewall as well as Panorama are set to the same time/time zone: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClXACA0 and make sure that Firewall is added to log collector under: Panorama > Collector Groups > [Collector Name] > Device Log Forwarding > Devices > Modify > [Select Firewall] and press OK to apply. Do not forget to commit this change and push configuration to log collector under Commit > Push to Devices > Edit Selection > Collector Groups > [Collector Name] > OK.   Kind Regards Pavel ... View more