About PavelK

Thank you for reply @DavidyPalo   Since you can ping Switch from Firewall and it is directly connected link, there should be no issue with routing. Have you checked Firewall's Traffic log to confirm ICMP arrives Firewall? Unless you have custom rule, this should hit by default: intrazone-default rule. Make sure that logging is enabled under: Actions > Log Setting > Log at session end, otherwise you will not see any logs hitting this rule. Note: I can see that you have not configured Interface for static route. It is not mandatory if you have next hop, however if you want to make sure that next hop is reachable over certain interface you can hardcode it.   Kind Regards Pavel ... View more

Thank you for post @DavidyPalo    By default Firewall is using management interface for ping. If you want to verify reachability of data plane interface you can change source: ping source <int 1/2 ip address> host <destination ip>   Kind Regards Pavel ... View more

Thank you for the post @Bo_Olsen   Could you go in Panorama to: Monitor > Logs > GlobalProtect, then click on arrow to add: "Client Version": Your Firewall has to be configured for log forwarding under: Device > Log Settings > GlobalProtect > Forward Method > Panorama.   Could you please check whether the above meets your requirements?   Kind Regards Pavel  ... View more

Thank you for the post @ChristianBolelli   Could you make sure that this Firewall has installed latest threat updates? This signature is available and action can be changed. Could you go to your vulnerability profile and select: Show all sinatures:   Kind Regards Pavel   ... View more

Thank you for reply @Maryan I am sorry, I can't completely follow what you described. I have a feeling that the reason why you can't see the syslog server in Device Group is the fact that you will be able to override Log Forwarding profile to add Syslog server only in Device Group where Firewall is located with associated Template Stack that includes Syslog server. This is where Syslog server setting is coming from. Based on my experience, there is an order of operation. For example when I onboard a new Firewall I first push Template Stack + Device Group. Once this is applied to Firewall, I go to Device Group one more time where new Firewall is located and then override Log Forwarding Profile to add Syslog server, commit and push again to Firewall. This scenario works for me and once this is applied, I can see logs being sent from Firewall to syslog server.   Kind Regards Pavel ... View more

Thank you for quick reply @ITISNetwork   As next thing I would be looking into whether all services are running by checking below from Panorama's CLI:   show system software status show log-collector-es-cluster health   I would also check for any errors in log: tail lines 200 mp-log ms.log as well as under: Monitor > Logs > System.   Have you tried to reboot Panorama?   Kind Regards Pavel ... View more

Thank you for the post @SrinivasaReddy - Would it be possible to share the error you are getting? You can re-call the error from: Panorama > Managed Devices > Summary > Shared Policy Last Commit State / Template Last Commit State. - Are you failing to push Device Group and Template stack configuration? - What PAN-OS version are you running on Panorama and Firewall?   Kind Regards Pavel ... View more

Thank you for the post @JimMcGrady   I am not aware of any equivalent of TCP ping in PAN-OS and I do not believe such feature exists. When I have to do some basic verification of reachability from Firewall against certain TCP port, I am using SSH. For Example below sample:   When I get a response that it was closed by remote host, I know there was a response. I know it is limited and completely corresponding with your requirement, but this might be one of the workaround.   Kind Regards Pavel ... View more

Thank you for update @ITISNetwork   If logs are still not showing after 1 hours. Could you please check status of ElasticSearch of log collector:  show log-collector-es-cluster health The status should be green. Also, could you confirm that log collector is connected and in sync from: Panorama > Managed Collectors?   Kind Regards Pavel ... View more

Thank you for the post @ITISNetwork   Based on my experience after Panorama upgrade it can take up to 1 hour to logs be searchable. If you have just finished upgrade, I would wait a bit. This should not be related to any compatibility. As long as Firewall is running lower PAN-OS version than Panorama will work.   Kind Regards Pavel    ... View more

Thank you for the post @Maryan   I came across the same issue in the past with the same scenario you described.   The issue I have seen is, the syslog server configuration is coming from Template while log forwarding is coming from Device Group. By doing some testing, I have realized that syslog server will appear in the drop down list in log forwarding profile only if that Device Group has some firewall assigned that is linked to Template with syslog server configuration. For all Device Groups in top hierarchy that do not have any firewall assigned to, it did not show the syslog server in log forwarding profile.   I came up with 2 possible workarounds: - Move one of the firewall, this could be some dummy firewall to Device Group in top of your hierarchy. If this firewall is linked to Template Stack with syslog server, you should be able to see it in dropdown list in all child Device Groups. This is not a nice way to position a firewall though. - Alternative way would be to go to each child Device Group for each site (Equipment 1 / Equipment 2 in your case) and click on override log forwarding profile, then select syslog server from drop down list. This will be however time consuming and defeating a purpose of hierarchy of Device Group.   I tested both scenarios and both worked for me, however I am aware that both are not real solutions but rather workarounds. I remember, I talked to my Palo Alto partner at that time, but I could not get any solution for this, therefore I would appreciate myself if anybody has different experience or solution.   Kind Regards Pavel ... View more