About PavelK

Thank you for the post @AOneR   in the validation error you shared, the interface that is having an issue is "ethernet1/1.88" while in your post you mentioned you experienced a problem with the interfaces "ethernet1/5.88" and "ethernet1/6.88". Is the issue with "ethernet1/1.88" related to your post or different issue?   Regarding the first problem you reported with validation error, could you use one of the interface that is functional in your Template and use "Global Find" to see where it is all referenced in Template, then mimic the configuration for sub-interface ethernet1/5.88? Make sure that virtual router, virtual system, zone are assigned.   Regarding the second problem, the only time I have seen missing setting while pushing Template Stack to a Firewall is one of below scenarios: - The configuration is pushed but not applied because it is overwritten by local configuration. You will recognize it by different symbol shape. Instead of green, it is green/orange symbol. Here is a reference: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLIxCAO - A Template is not part of correct Template Stack or Template is not a member of  any Template Stack. - The Panorama configuration is committed successfully, but an error is returned while pushing the configuration to the managed Firewall.   If none of the above scenario is applied to you, then I would go through the Template configuration again and make sure that the interface "ethernet1/6.88" is configured correctly.   Kind Regards Pavel ... View more

Thank you for the post @ongkai   from the screen shots you shared, my best guess is that Firewall that you marked as working is supporting multi vsys.   user-id-hub - means Inter-Vsys User-ID information sharing is enabled. Here is a link for documentation: https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/user-id/deploy-user-id-in-a-large-scale-network/share-user-id-mappings-across-vsys   address and address-group - means shared objects for multiple virtual systems. Here is a link for documentation: https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/virtual-systems/virtual-systems-overview/shared-objects-for-virtual-systems   Kind Regards Pavel ... View more

Thank you for the post @GKumar   in order to forward all Firewall logs from Panorama to 3rd party syslog server, you have to set it up under log collector. Please navigate to: Panorama > Collector Groups > [Click on Collector Group name] > Collector Log Forwarding > Then navigate to Traffic, Threat, URL,... click on add and select syslog server profile.   Here is the corresponding KB: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClIsCAK   Please note that if you have multiple log collector groups, you will have to the the same setting for each log collector group. Also do not forget to commit configuration and push the configuration to log collectors. After this step, you should be able to see Firewall logs in Qradar   Kind Regards Pavel ... View more

Thank you for the post @Bumenang   one way to go about it is to configure all Firewalls to send configuration logs to Panorama. This setting is under: Device > Log Settings > Configuration > [Configure new profile and select Panorama check box]. Then in Panorama configure under: Device > Log Settings > Configuration a new Configuration profile with below filter:   ( full-path contains 'rulebase/default-security-rules/rules/entry[@name=\'intrazone-default\']' ) or ( full-path contains 'rulebase/default-security-rules/rules/entry[@name=\'interzone-default\']' )   and add an email profile:   With the above configuration every time, somebody changes intrazone-default or interzone-default rules, you will get an email alert.   Kind Regards Pavel   ... View more

Thank you for the post @StevenTurner   I just looked into my BGP peer and I can see hundreds of policy rejected routes. In my case, I credit this to BGP Import map with exact match. Import list would be the first thing I would be looking into. If you have any filter in place, add this route to the list.   Kind Regards Pavel ... View more

Thank you for feedback and sorry to hear that @bvandi   to be honest, there is not much I can add to this. Myself, I am no longer facing this issue and can't comment on this anymore. At this point I would open a ticket to TAC to address this issue.   Kind Regards Pavel ... View more

Thank you for the post @bschaper   silly question, have you upgraded SD-WAN Plugin to version 3.0? This version is required for PAN-OS 10.2: https://docs.paloaltonetworks.com/plugins/vm-series-and-panorama-plugins-release-notes/panorama-plugin-for-sd-wan/sd-wan-plugin-300/features-introduced-in-sd-wan-3-0   Kind Regards Pavel  ... View more

Today, PAN-OS 9.1.14 was released. This issue was addressed in this release: PAN-189468   https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-release-notes/pan-os-9-1-addressed-issues/pan-os-9-1-14-addressed-issues#panos-addressed-issues-9.1.14   Kind Regards Pavel ... View more

Thank you for reply @JoeKwok   unfortunately, I do not believe that there is a such documentation that is publicly available. Prisma SD-WAN is an acquisition of CloudGenix. The coverage in documentation is from my point of view a bit behind what we are used to with other Palo Alto products.   Kind Regards Pavel ... View more

Thank you for reply @Fagani   unfortunately based on information from your reply, I am having a difficulty to understand what the issue could be. If I were in your situation, my starting point would be looking into URL logs. The first thing I would make sure that all allowed URL categories have action set to alert. Alert action allows traffic and records the logs. Also for the policies that are getting hit by this traffic, I would check in the traffic logs for "byte received" to confirm there is a response from web server.   Kind Regards Pavel ... View more

Sorry to suddenly jump into this discussion. I have enabled: "Certificate Expiration Check" on all Firewalls (Pushed globally by Panorama), however I have never seen any log generated even though the certificate already expired, so last year I have opened a TAC case. TAC engineer was able to reproduce the issue and escalated this to engineering team. After approximately half year of waiting, I got this reply: "I have got an update from our engineering. Your reported issue was marked as an enhancement request. We will not change the current behavior as a bug. If you want to request us to change this behavior to your expectation, please contact our account team to submit a Feature Request."   Based on my experience, there is a chance that feature: Certificate Expiration Check might not work as expected.   Kind Regards Pavel ... View more

Thank you for reply @JohnSmock   I have upgraded from 9.1.13 to 9.1.13-h3. For Firewalls, I proceed with the upgrade to the same version after Panorama upgrade is completed. Sine we have 150+ Firewalls, typically the moment all upgrades are completed, the new version is out.   Kind Regards Pavel ... View more