About PavelK

Thank you for post @d.spider   the first thing I would suspect is session offloading:   https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CldYCAS Kind Regards Pavel   ... View more

Thank you for the post @tamilvanan   First of all, I agree with you that it is better and safer to managed HA locally instead of using Panorama. Overall, your design of Templates/Template Stack looks good and to me it looks functional. The only thing I am worried about is pushing of setting from Template (HA setting, interfaces,..) will not be applied if Firewall has already existing overlapping configuration. You will have to override it locally to apply Panorama pushed configuration: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000008UgMCAU&lang=en_US%E2%80%A9 Alternative approach is to select: "Force Template Values" while pushing configuration, but this involves risk that local config that is not included in Template will be wiped, so I would go with overriding it locally as this is only one time job.   Could you please post back how well this went? I am wondering how smooth it was.   Kind Regards Pavel ... View more

Thank you for the post @securehops   Have you installed any application content update in Panorama? Advanced URL Filtering License has a dependency on content update. The version 8390-6607 and higher has to be installed. I am not sure whether this could prevent Panorama from fetching the license, but if you have not installed latest content or have installed older than 8390-6607, I would try to install it from: Panorama > Dynamic Updates > Applications and Threats, then refresh license status from: Panorama > Device Deployment > Licenses > Refresh.   Kind Regards Pavel ... View more

Thank you for the post @jguffroy   Based on screen shot you supplied it is not clear what the root cause is. Would it be possible to navigate in the log to very left side and click on magnifying glass, get session ID from denied and allowed log, then navigate to Firewall's CLI and check/compare details of each session?   show session id <session id>   Kind Regards Pavel ... View more

Thank you for the post @Srikanth-R   Regardless of platform (HW Series or VM) and regardless of PAN-OS version, the reboot is required for enabling/disabling jumbo Frames to take an effect: https://docs.paloaltonetworks.com/vm-series/10-1/vm-series-deployment/about-the-vm-series-firewall/enable-jumbo-frames-on-the-vm-series-firewall.html   I would recommend you to schedule a maintenance window to proceed with this change.   Kind Regards Pavel  ... View more

Thank you for the post @Lakshmikanth   Unfortunately, there are no specific debugs / diagnostics for vwire, so troubleshooting is limited. Have you tried to check basic things like duplex/errors/drops of interfaces configured for vwire from CLI: show interface <interface name> ?   Kind Regards Pavel ... View more

Thank you for reply and sorry for late response @JeffKim   Since based on CLI output you provided, the status of ElasticSearch is not red and based on debug of log collector there are logs coming there seems to be no reason the logs should not appear under secondary log collector. At this point, I would generate tech-support file from log collector and open a TAC ticket.   Kind Regards Pavel ... View more