About PavelK

Thank you for the post @JeffKim   If log forwarding preference is set correctly, then this is not expected behavior. Could you do basic verification from CLI to verify all services are running and status of elastic search:   show system software status show log-collector-es-cluster health show log-collector detail   I would also check on one of the Firewall that is supposed to send logs to log collector to confirm log forwarding preference list and logging status: show log-collector preference-list show logging-status   If none of the above does not reveal any obvious issue, I would try to restart service on Panorama: debug software restart process logd   Kind Regards Pavel   ... View more

Hello @MichaelMadl   could you please confirm you can see below icon in policy?   The Geo Location database is coming from content updates. Could you make sure your management interface can access internet and could you install latest content updates?   Kind Regards Pavel ... View more

Thank you for the post @Mostafavi_DWR   In PAN-OS 9.1.12 there is no known issue for ElasticSearch. When status is red, there is not much you can do. I would give log collector reboot. If the issue continues after reboot, I would generate tech-support file and open ticket.   For the second issue, do you mean that log collectors are not showing status under: Panorama > Managed Collectors? As a next thing, I would check logs on log collector: tail lines 200 mp-log ms.log to see it can give more information. After upgrade the log collector should try to connect to Panorama on TCP: 3978. If on Panorama status is showing properly either something is preventing to connect or log collector is not initiating connection.   Kind Regards Pavel  ... View more

Thank you for the reply @Bo_Olsen   I believe the reason why you do not see this option is PAN-OS version. Global Protect log was introduced in PAN-OS 9.1. If you happen to be on PAN-OS 8.1 or 9.0, I would recommend you to upgrade Panorama as well as managed Firewall to 9.1 as versions 8.1 and 9.0 will be end of life on 1st March 2022. This upgrade should resolve your issue with GlobalProtect log forwarding.   For the upgrade itself, the order of operation is to upgrade Panorama first, then managed Firewalls. Also watch out for changes to default behavior: https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-release-notes/pan-os-9-0-release-information/changes-to-default-behavior.html   Kind Regards Pavel ... View more

Thank you for the post @popeja   Could you make sure that managed Firewall was removed from below configurations:   - Panorama > Device Groups > Then navigate to Device Group: Branch_Single-Homed, then deselect Firewall from Device Group.   In addition, to properly remove managed Firewall from Panorama, I would recommend remove it from below sections:   - Panorama > Templates > Then navigate to Template Stack where Firewall is located, then deselect Firewall from Template Stack.   -  Panorama > Collector Group > [Collector Group Name] > Device Log Forwarding > Log Forwarding Preferences > Modify > Then deselect Firewall. This option is relevant if you collect logs from managed Firewall.   - Panorama > Device Deployment > Dynamic Updates > Schedules > [Scheduler Name] > Then deselect Firewall. This option is relevant if you install updates from Panorama to managed Firewall.   After you complete all these steps, there should be nothing left preventing you to commit it.   Kind Regards Pavel ... View more

Hello @Shikha652   I am not aware of any built-in Panorama feature to get alert for out of sync Firewalls, however you could get around it by setting up email alert against system logs. The reason why out of sync happens is because changes that are committed to Panorama's Device Group/Template are not pushed to managed Firewalls. If the push fails, there is an system log generated. For example below filter:   Kind Regards Pavel   ... View more

Hello @MatthewKruc1177   could you please check reason why configuration pushing is failing from Panorama to this Firewall? You can re-call details of last failure from:   Panorama > Managed Devices > Summary > [Search firewall that is out of sync] and navigate to Shared Policy Last Commit State / Template Last Commit State, then copy details from: Last Push State Details window.   There are many reasons why managed Firewall gets out of sync, but getting details of failure would be starting point. Also make sure that Panorama is running higher or the same PAN-OS version than managed Firewall.   Kind Regards Pavel ... View more

Thank you for the post @BigPalo   If you are looking only into fixing vulnerability issue, then today, Palo Alto released version with fix: 9.0.15, 9.1.12-h3 and 10.0.8-h8, so you do not have to go all the way up to: 10.1.3-h1. Regarding backward compatibility between Panorama and managed Firewalls, as long as Panorama is running higher version than managed Firewall all should work, however based on my experience, by pushing configurations to Firewalls running 8.1 I occasionally get minor issues that config was not applied. Lastly, PAN-OS 8.1 and 9.0 will be end of life on 1st March 2022, so you should look into upgrade soon.   Kind Regards Pavel ... View more

Thank you for reply @SrinivasaReddy   It looks like it is failing while pushing Template. If this is is related to Device Group, could you try to follow order of operation to push Template Stack first, the Device Group?   Could you check whether below logs from Panorama can give more information or indication what the root cause is:   less mp-log ms.log less mp-log configd.log   Kind Regards Pavel ... View more

Hello @DavidyPalo    could you click on green gear icon and press override? then you will be able to edit and commit the change.   Kind Regards Pavel ... View more

Thank you for reply @DavidyPalo   it is under security rule: Kind Regards Pavel   ... View more