About PavelK

Thank you for post @roma   this is expected, the security rule: intrazone-default has default action allow while interzone-default has default action deny, so the log you are seeing are corresponding with security rule action.   Kind Regards Pavel ... View more

Thank you for the post @BabajideM   could you check below points:   1.) Make sure that Log Collector's serial number and password in Panorama under Managed Log Collectors are correct. 2.) Make sure that PAN-OS of Log Collector is the same or lower than the one running on Panorama. 3.) I would also make sure that log collector is configured to use the same time zone as Panorama and that DNS server is configured:      set deviceconfig system timezone <Time Zone>      set deviceconfig system dns-setting servers primary <IP address> secondary <IP address> 4.) Make sure log collector is added to log collector group and push the configuration to log collector group by: Commit > Push to Devices > Collector Groups > [Log Collector name]. 5.) Make sure that App content version installed on Log Collector is the same as the one on Panorama. 6.) On Panorama side, I would check the output from: show netstat numeric yes | match 3978      Could you also take packet capture on Panorama side? You can use Log Collector's IP address as a filter. Make sure that TCP 3978 between Panorama and Log Collector are open.   Kind Regards Pavel ... View more

Thank you for the post @miaocongcong   I experienced exactly the same issue in mid of February after I upgraded PA-3220 to 9.1.13. The command you executed: "debug dataplane pool statistics" is the right way to drill down the issue. As an immediate measure we failed over the Firewall and rebooted the one that was having an issue and opened a TAC case. After spending some time on the call, TAC advised to downgrade the Firewall that solved the issue, however we could not get anything official regarding bug. Based on the input from TAC, in version 9.1.13 there were some issues that engineering team is looking into, but there is no official bug id for this.   Kind Regards Pavel ... View more

Thank you for the post @CraigAddison   I have hit a similar issue a few times in early releases of 9.1. I only managed to resolve it by reboot. I would recommend to upgrade to 9.1.13-h1.   I do not see direct correlation between disk space and issue you are experiencing. If the log quota is full, the logging will still continue to work. Old log will be simply overwritten with new log.   Regarding clearing of diskspace you may refer to these KBs: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClaJCAS https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClimCAC   Kind Regards Pavel ... View more

Thank you for the post @BCUHBDataCommsTeam   As of now, Hide My Ass is not classified as own application. Hide My Ass is using openvpn client, so you will likely see it classified as openvpn.   Kind Regards Pavel ... View more

Thank you for reply @Deepak25   1.) Personally I would advice to go with this option: "Create new log forwarding preference list for some firewalls from the list and keep new LC as a primary and others as secondary , tertiary." The log forwarding preference only defines which log collector ingests the logs, but the log location among log collectors in the same log collector group is determined by hash algorithm, so the logs do not necessarily have to reside in the first log collector in log forwarding preference list. Full details are provided in this article: https://docs.paloaltonetworks.com/panorama/9-1/panorama-admin/panorama-overview/centralized-logging-and-reporting/caveats-for-a-collector-group-with-multiple-log-collectors.html   2.) You do not have to modify this setting. On the Firewall side, you configure only Panorama Manager IP address (Primary and Secondary in the case of HA), so you can keep this setting as it is after you bring 3rd log collector online. The Firewall will learn log forwarding preference after it is registered to Panorama Manager.   3.) The answer to this question is provided in the link, I shared in the point no.1. Basically, all log collectors in the same log collector group are working as one storage and all log collectors are storing logs. When it comes to enabling log redundancy across log collectors, there is one caveat: Log redundancy is available only if each Log Collector has the same number of logging disks.    4.) I do not have confidence to answer this question without knowing your environment, however the disk quota is configuration that will not change by adding new log collector. For actual utilization, by adding 3rd log collector, you will get more storage, but if you have a lot of logs, you will eventually reach 100% utilization, but you will have longer retention period.   There is one more point that I forgot to mention in my earlier post, for log collector you will need this license: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PNu0CAG&lang=en_US%E2%80%A9   Kind Regards Pavel ... View more

Thank you for the post @inderjit21 you will have to upgrade Panorama to 10.1 first.   Kind Regards Pavel ... View more

@jasonrakers thank you for quick reply. I see. I was not able to preproduce this issue with 9.1.12-h3, however I would appreciate feedback if you find a resolution through TAC.   Kind Regards Pavel ... View more

Thank you for the post @Deepak25   1.) In this scenario, the only option is to configure new M-200 as a dedicated log collector: https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/manage-log-collection/log-collection-deployments/deploy-panorama-with-dedicated-log-collectors.html Since you are using Panorama HA with built in log collectors, there is no option to expend it unless you configure the new M-200 in logger mode and register it to existing Panorama as a dedicated log collector. 2.) Technically the only requirement to add a new log collector to existing log collector group is to have the same hardware which you have. After you register new M-200 to Panorama, you should be able to add it to log collector group under: Panorama > Collector Groups > [Log Collector Group Name] > Collector Group Members > Add 3.) Adding new M-200 will increase capacity, but keep in mind a few points: - By having the option: "Enable log redundancy across collectors" enabled, a single log will be stored in 2 different log collectors. Please refer to the: "Log Redundancy" in this link: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HBw7CAG - New log collector will have this portion of the log: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PPcwCAG - After you add Log Collectors to an existing Collector Group, Panorama redistributes its existing logs across all the Log Collectors, which can take hours for each terabyte of logs. During the redistribution process, the maximum logging rate is reduced. In the Panorama Collector Groups page, the Log Redistribution State column indicates the completion status of the process as a percentage. 4.) The logs will be ingested by new log collector depending on how you set up device log forwarding in log collector group, then actual log will be stored in 2 log collectors across log collector group by using internal algorithm. 5.) I think, I answered this by above 4 points, but if there is any question, I will try on best effort bases help.   Kind Regards Pavel Kucera ... View more

Thank you for the post @jasonrakers   After you create a variable, it should be selectable from the drop down menu. If you can't see it, would it be possible to navigate first to Template/Template Stack where you want to create a static route and create a variable from there? Please refer to Step No.3: https://docs.paloaltonetworks.com/panorama/9-1/panorama-admin/manage-firewalls/manage-templates-and-template-stacks/configure-template-or-template-stack-variables.html then come back to the Template/Template Stack and confirm you can see it from drop down in the static route's destination field?   Kind Regards Pavel ... View more

Thank you for the post @surkumar   You can configure data plane interface as HA port. Please refer to Step No.3: https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/high-availability/set-up-activepassive-ha/configure-activepassive-ha.html. After I convert a data plane interface into HA port, you will be able to select it from HA configuration drop down list. If you have enough interfaces, please reserve dedicate port for HA1 and HA2.   Kind Regards Pavel ... View more

Thank you for the post @jirasith   I am afraid that only option is to set it up per security rule. For all new rules, if you name log forwarding profile as: "default" it is automatically added added to the rule, but this will not help you with existing rules. Please check documentation, step 2:   https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/monitoring/configure-log-forwarding.html   Kind Regards Pavel ... View more