About PavelK

Thank you for the post @hoangtung225   If you have already advertised your address block by BGP to ISP and receive a default route/full BGP feed from ISP, then next thing would be NAT configuration. If you are planning to do NAT on the same Firewall, then there are many resources and KBs from Palo Alto for NAT configuration. Here is one KB to get started: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CllzCAC   Depending on the size of your organization, for source NAT, if number of clients behind NAT is high, then I would recommend to create an address pool with several IPs from your IP block and use it for address translation with translation type: Dynamic IP and Port. If number of clients behind NAT is small you can use a single IP address combined with with translation type: Dynamic IP and Port. Since you have your own IP block, you can avoid doing NAT to interface that is using ISP assigned IP addresses.   Kind Regards Pavel ... View more

Thank you for the post @ChristianBolelli   As long as VR is associated with any interface, static route, OSPF process,... Panorama will give you an error. You will have to remove these dependencies first before you can delete VR. The order of operation would be to remove anything associated to VR for example interfaces, OSPF and migrate it to different VR, then you can delete it. The deletion of VR itself will not impact other VRs, so you should not have an outage with other VRs running OSPF.   Kind Regards Pavel ... View more

Thank you for posting question @Maria-Victoria   Panorama does not have any data plane and is not processing any traffic like Firewall does. If you mean checking of the logs from Firewalls, then as long as Firewall is registered in Panorama and sending Threat logs you should be able to see it under: Monitor > Logs > Threat.   If you are referring to something else could you please provide more details what you are looking into?   Kind Regards Pavel ... View more

Hello @AaronDeRooy    When it comes to Panorama as long as Panorama is running PAN-OS version higher than managed Firewall you will not have an issue to manage Firewalls and collect logs, so in your case you will not have issue to manage Firewalls running 9.1 after upgrading Panorama to 10.1.   For now, I am only worried about customers running M-100 that can run highest version 9.1. For those like @ChristianBolelli  mentioned Palo Alto will hopefully release Hotfix in 9.1 release.   Kind Regards Pavel  ... View more

Thank you for reply @PAFrank   Yes, I would recommend to move to version 9.1.X.   Kind Regards Pavel ... View more

Thank you for quick reply and clarification @RobertShawver   I now understand what you mean. I just had a look and I can see the same thing. When I click on Install "Apps", only Firewalls that do not have Threat Prevention license are showing up in the list. When I click on "Contents", I can see in the list, all Firewalls with Threat Prevention license. I think this is expected. Firewalls that do not have Threat Prevention license can't install any signatures, therefore are only listed under "Apps". If you are seeing Firewall to show up in wrong list, could you try to refresh license from Panorama.   Kind Regards Pavel ... View more

Thank you for posting question @RobertShawver   Only to confirm, are you referring to setting under Panorama > Device Deployment > Dynamic Updates > Schedules > Add > Type: App, Download and Install? I just had a look into my Panorama instance and I can see only Firewalls that do not have Threat License when I select Type: App. When I change type to App and Threat, I can see Firewalls with Threat License.   Could you confirm license status of Firewalls that are showing up when you select Type: App? If Panorama is not updated with License status of managed Firewalls you can refresh license status from:  Panorama > Device Deployment > Licenses > Refresh. Ultimately, if managed Firewall is properly registered in Panorama and licensed, you should be able to see it under Device Deployment.   Kind Regards Pavel ... View more

Thank you for the post @PAFrank   This looks like compatibility issue. For ESXi 6.7 the minimum supported PAN-OS version is 8.1: https://docs.paloaltonetworks.com/compatibility-matrix/vm-series-firewalls/vms-series-hypervisor-support.html   Is version you are running 8.0 or 8.1?   Kind Regards Pavel ... View more

Thank you for posting question @JimMcGrady    If signature is getting hit, you can check it in the Threat Log under: Monitor > Logs > Threat. You can narrow down to specific signature by this filter: ( threatid eq <signature ID>).   In order to check signature itself from Firewall navigate to: Objects > Security Profiles > AntiSpyware > [Profile Name] > Exceptions (Click: "Show All signatures"). You can filter the output to specific signature: ( id eq 'Sugnature ID' ). From here you can see default signature action under: "Action". If there is a rule that is overriding default signature action, you will see it under: "Rule". You can use the same way to check Vulnerability Signatures.   Kind Regards Pavel ... View more

Thank you for the post and sorry to hear you are facing an issue @aerspa   Based on your screen shot, the Auto Commit is failing. Without Auto Commit to be completed, your data plane interfaces / HA will be not functional. It looks like you are using an EDL. If you are using custom EDL potentially you might be hitting what has been discussed in this thread: https://live.paloaltonetworks.com/t5/general-topics/auto-commit-failing-interfaces-down-not-able-to-force-commit/td-p/366907   If the above is not the case, then I would try to downgrade to 10.0.8-h4.   Kind Regards Pavel ... View more

Thank you for posting question @TFukumoto5   There are 2 ways to manage Prisma Access. One option is to use the plugin for Panorama. In this case you can leverage Panorama API to manage Prisma Access: https://docs.paloaltonetworks.com/prisma/prisma-access/prisma-access-panorama-admin/prisma-access-overview/prisma-access-apis.html   Second option is to use Prisma Cloud Management. Based on my information the Prisma Cloud Manager will be getting full API support before end of this year or in January 2022. As of now, it is possible only to retries IP addresses by API and nothing else: https://docs.paloaltonetworks.com/prisma/prisma-access/prisma-access-panorama-admin/prisma-access-overview/retrieve-ip-addresses-for-prisma-access   Kind Regards Pavel ... View more