About PavelK

Hello @Sec101   The logs are not being compressed while stored in Panorama VM. The only compression option that is available is directly on dedicated log collector for inter log collector log replication with this command: "debug log-collector inter-log-collector data-compression set on".   Kind Regards Pavel  ... View more

Thank you for reply and sorry for getting back to you with delay @kakuda.tomoyuki   Last week, I had Palo Alto Professional Services in house and I used this opportunity to ask for your case. Unfortunately, they could not give me any advice from the information that are available. I would recommend either to open a support case or contact Palo Alto and book a project with Professional Services for this migration. The latter option will cost money.   Kind Regards Pavel ... View more

Thank you for reply and additional information @b.nazir   I see. I just crosschecked setting on my side and searched my mailbox and I realized that I am getting these license expiration alerts directly from the Firewalls instead of from Panorama. The syslog as well as email profiles are pushed from Template. I have an email alert on Panorama for critical severities, but this alert comes from Firewall itself. I could not find any reference whether this is supported, however all examples from KB are referring to setting this up locally on Firewall, so potentially this is not supported from Panorama.   Kind Regards Pavel ... View more

Thank you for the post @MohammedAsikM   Based on my research, the content update 8447-6897 was released on 17th August 2021. In the Customer Support Portal as well as directly on the Firewall only latest content updates can be searched and referenced for release notes.   Myself if I need to reference old content update, I search it in the archive email that I subscribed to from: "Palo Alto Networks Content Update <updates@paloaltonetworks.com>" then I can reference this information several month back.   Coming back to your question, here is the link for new apps introduced in that content update: https://live.paloaltonetworks.com/t5/customer-resources/new-app-ids-for-august-2021/ta-p/426811   Here are screens from the email notification:     I hope this is information you were looking for.   Kind Regards Pavel ... View more

Thank you for the post @ChrisIsett   With older version of PAN-OS you are left only with limited options to get SFP information through system state:   https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cmn6CAC&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail   https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000boFQCAY   This unfortunately does not give more detailed information regarding TX/RX Power, Voltage,... Other than this, I do not believe that with PAN-OS 9.X you can drill down more information directly out of the box.   Kind Regards Pavel   ... View more

Thank you for the post @Joshan_Lakhani   I would try to enable debug to see it can give more details of the root case:   debug user-id set agent basic debug user-id on debug   Then check the result of debug:   tail follow yes mp-log useridd.log   and then disable debug:   debug user-id off debug   Kind Regards Pavel ... View more

Thank you for posting question @morahman   Unfortunately, this is not the case. The PAN-OS version information is not updated automatically. This has to be done manually in the portal.   Kind Regards Pavel ... View more

Thank you for posting question @b.nazir   Getting email alerts from Panorama for Firewall System Logs is functional feature and these alerts are not limited to Panorama System Logs. By looking into my Panorama setup where this is working, the setup is fairly straightforward and based on what you described your setup should work. Just in the case, could you please confirm that you configured it in a similar way as below example for critical logs.     Kind Regards Pavel   ... View more

Thank you for reply @Alpalo   Do you mean you imported local Firewall configuration into Panorama and pushed it back to Firewall from Device Group?   Kind Regards Pavel ... View more

Thank you for posting question @Adnan_SA   If your firewall is already managed by Panorama and all configuration under virtual router were configured by Panorama's Template, then you can just navigate in Panorama to: Templates > Network > Virtual Routers > Static Routes > change: Next Hop, then commit to Panorama and push to device > Templates and then select Template Stack to be bound to Firewall.   If your Firewall is managed by Panorama, but you are not using Template to manage virtual router configuration, you can still create a Template with new configuration under: Templates > Network > Virtual Routers > Static Routes > change: Next Hop, then you have 2 options to push this configuration: - You can select: "Force Template Values", then all your locally configure virtual configuration will be replaced with what you have configured in Template. Proceed with caution while using this as all non Template defined configuration will wipe locally configured configuration causing outage or undesirable outcome. Here is corresponding KB: https://knowledgebase.paloaltonetworks.com/kcSArticleDetail?id=kA10g000000PMj1&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FkcSArticleDetail   - An alternative way is to proceed with the same configuration in Template, but do not select: "Force Template Values", then Template configuration will be pushed to manage Firewall, but will not be applied. This icon will be shown:   in local Firewall and you can click on this icon and override local configuration. In this way you are in control what gets overridden.   There are more ways to go around it, but this might be either overkill or not practical if you are aiming to change only single configuration.   Kind Regards Pavel    ... View more

Hello @BigPalo this is an old thread and I can't comment what the original issue was 5 years ago, however at least from my own experience this is functional. I have pushed custom response page via Template to 150+ Firewall from Panorama using different mixture of PAN-OS and it is working fine.   Kind Regards Pavel ... View more

Thank you for posting question @GideonKonga   Unfortunately, only one interface can act as an RP at the time. I can't think of any way around it except of configuring an additional Virtual Router and assign interfaces to this Virtual Router and configure multicast here.   Would it be possible to elaborate more what you would like to achieve? Potentially, there might be a better way to solve the issue.   Kind Regards Pavel ... View more

Thank you for the message @m.dmitriev    The GRE encapsulation should be enabled on both sides. Without both sides having GRE in place, the traffic that gets encapsulated by GRE on one side would not be able to get decapsulated on the other side of the tunnel. Regarding your second question, unfortunately, I do not have any hands on experience with Mikrotik.   Kind Regards Pavel  ... View more