About PavelK

Thank you for reply @Joshan_Lakhani    I used this syntax: scp export stats-dump start-time equal 2021/09/13@00:00:01 end-time equal 2021/10/13@23:59:59 to username@server:/   Kind Regards Pavel ... View more

Thank you for the post @Joshan_Lakhani    I just tried on one of the Firewall running PAN-OS 10.0.7 to generate Stats Dump File with time range 1 month and it run successfully. Are you getting any error? Have you tried to restart management process?   Kind Regards Pavel ... View more

Thank you for posting question @JimMcGrady   The issue you are experiencing is likely related to this KB: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClyBCAS   I was doing a few tests with following findings: When custom report was small, for example last 1 hour of traffic, while exporting to PDF, I was able to see resolved hostnames in PDF report, however when I changed it to 30 days of traffic, I was not able to see hostnames in exported PDF.   Would it be possible to limit the query or split it into multiple reports to see it makes any difference?   Kind Regards Pavel ... View more

Thank you for quick reply @SubaMuthuram    I see. For ZTP, there is different procedure: https://docs.paloaltonetworks.com/panorama/10-0/panorama-admin/manage-firewalls/set-up-zero-touch-provisioning/add-ztp-firewalls-to-panorama/add-a-ztp-firewall-to-panorama.html#id182211ac-a31c-4122-a11f-19450ec9ca4e Have you followed this manual?   Kind Regards Pavel  ... View more

Thank you for posting the issue @SubaMuthuram   Would it be possible to take packet capture from management interface to get more visibility into TLS Handshake? You can use filter: tcpdump filter "port 3978" (https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CleECAS)   On Panorama side, the output from: "show devices all" should for functional registration with predefined certificate return:   Certificate Status: Certificate subject Name: <Firewall Serial Number> Certificate expiry at: <Predefined Certificate Expiration Day> Connected at: <Last Connected Time> Custom certificate Used: no   Could you please confirm what are you seeing on your side?   Thank you and Regards Pavel Kucera ... View more

Thank you for posting question @jdemares   Based on what you have written I assume you are planning to migrate to standalone M-200 with no HA nor dedicated log collector. If my assumption is incorrect, please comment as this affects the answer.   I would proceed with the following steps:   Perform the initial configuration of M-200: Configure management interface IP address/Hostname/DNS Server/Time Zone/password, add license, upgrade to target PAN-OS, install latest: Applications and Threats / Antivirus packages. By default Panorama comes up in: "Panorama Mode" which allows you to run it as local log collector. Go to M-100 and navigate to: Panorama > Setup > Operations, then click on "Save named Panorama configuration snapshot", enter a name to identify the configuration, and click OK. Then click on "Export named Panorama configuration snapshot", select the name of the configuration you just saved, and click OK. Panorama exports the configuration to your PC as an XML file. Then go to M-200 and navigate to: Panorama > Setup > Operation, then click on "Import named Panorama configuration snapshot", browse to the configuration file you exported from the M-100 appliance and click OK. Then click on "Load named Panorama configuration snapshot", select the name of the configuration you just imported, and click OK. Panorama overwrites its current candidate configuration with the loaded configuration. Panorama displays any errors that occur when loading the configuration file. Since, M-200 has different hardware/interfaces you might have to manually adjust xml file exported from M-100 to match M-200 configuration. I would recommend to export configuration from M-200 and M-100 and compare it side by side, then manually adjust xml that is going to be loaded to M-200. The final step is to Commit > Commit to Panorama. Set up local log collector by following this KB: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PMTXCA4 If you did not run into any issue by following the above steps, then at this point I would move one of the M-100 managed Firewall to new M-200. The actual process is easy. On the Firewall side, navigate to: Device > Setup > Panorama Settings > [M-200 Management interface IP address]. On the M-200 side, navigate to: Panorama > Managed Devices > Summary > Add: [Serial Number]. Then add Firewall to relevant Device Group and Template Stack. Also add Firewall to log collector you created in previous step under: Panorama > Collector Group > [log collector name] > Device Log Forwarding > Add > [Select Firewall and corresponding log collector], then go to Commit > Push to Devices > Edit Selection > Collector Groups > OK > Push. After completing the above step, you should see Firewall to come online under: Panorama > Managed Devices > Summary. Note: PAN-OS of the Firewall has to be the same or lower than M-200. At this point Firewall will report that "Shared Policy" is "Out of Sync". Try to push the configuration to Firewall by going to: Commit > Push to Devices > Edit Selection > [Select Firewall] > Push Device Groups and Templates. If this step is successful, you should see the "Shared Policy" as "In Sync". As a next step, I would confirm that logs are being sent by Firewall and searchable in Panorama. If you do not see any logs to come, make sure you see log collector IP address under: "show logging-status" and "show log-collector preference-list". If you do not get desired output restart management process. If you have not hit any issue with first Firewall for configuration pushing as well as logging at this point I would consider to migrate rest of the Firewalls to M-200. If you still need old logs from your original M-100, there are several ways to proceed with log migration. One way could be to turn your M-100 to: logger mode, then add it to M-200 as log collector. Note: M-100 can run PAN-OS version up to 9.1. There is recommendation that Panorama as well as log collector should run the same version, however based on documentation log collector can run lower version which might be functional if your M-200 is running PAN-OS 10.X. The actual process to configure this is fairly straightforward, you will have to turn M-100 into logger: "request system system-mode logger" then "set deviceconfig system panorama-server <IP address of M-200>". The rest of the details can be referred from: https://docs.paloaltonetworks.com/panorama/10-0/panorama-admin/manage-log-collection/configure-a-managed-collector.html If the above step is successful, then you can still search old M-100 logs from dashboard of M-200, however I would use this only as a temporary solution until you finally retire M-100. Disclaimer: I am planning myself to proceed with Panorama migration in next year (Issue with delivery time), however to be honest I have not done exactly the same migration myself. As with every project, I come across unexpected issue or later when project is completed I realize that I could have done it differently or I discover better way, so do not blame me if some steps are not working as expected 🙂 If you get stuck or need more information do not hesitate to comment.   Kind Regards Pavel ... View more

Thank you for the post @nazrul13    Could you check in System log with filter: (subtype eq gre) any corresponding logs? What is the model of the router? If it is Cisco, could you turn debugs:  debug tunnel packet  debug tunnel keepalive  debug tunnel event   Kind Regards Pavel     ... View more

Thank you for posting question @JimMcGrady   I tried to simulate this use case with one of the Firewall that is currently not in use. Below are my findings:   When I tried to change Firewalls management interface IP address locally on the Firewall, after I committed changes, the Panorama's Automatic Connection Recovery has kicked in and rolled back the change to the original IP address.   On the second attempt, I disabled the Panorama's Automatic Connection Recovery feature from: Device > Setup > Management > Panorama Settings > [De-select] Enable automated commit recovery, then I tried again to change IP address and after commit was completed it worked well. After approximately 2 minutes, I have seen the Firewall in Panorama with new management IP address.   You might have to restart management process on Firewall to restart log sending if you are using Panorama also for log collection. After this change, I have not seen any issue with Firewalls Device Group / Template Stack. Overall it was smooth.   Outside of Panorama, if you change Firewalls management IP address you might have to reflect this change in your monitoring system, tacacs/radius server, syslog server,...etc.   If my test has not covered the issue you are trying to address or you are looking into something else, let me know.   Kind Regards Pavel ... View more

Thank you for the post @razzitpca   Could you navigate to: Monitor > Logs > Traffic, then search logs to confirm what rule is getting hit? To filter logs, you can use for example: ( port.dst eq 25). If you are seeing: "incomplete" message in the Detailed Log View, this indicates that TCP 3 way hand shake has not completed: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClibCAC   In order to drill down more into details of the traffic, I would recommend to take packet capture on data plane interface with the filter for this traffic, then export it and check it in Wireshark: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClTJCA0   Kind Regards Pavel   ... View more

Thank you for posting question @corporatenw    All firewalls shipped from the factory have two Ethernet ports (ethernet1/1 and ethernet1/2 ) preconfigured as virtual wire interfaces (default-vwire), and these interfaces allow all untagged traffic. The reference is here in the documentation: https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/networking/configure-interfaces/virtual-wire-interfaces.html   The rest of the data plane interfaces are using interface type: Tap. With default configuration you should not cause any loop.   Kind Regards Pavel     ... View more

Thank you for reply @howardtopher    I see, thank you for confirmation. I have PA-5260 running 9.1.5 (AUX-1 is not in use). I was doing some research on this to find out more.   The AUX-1 port is referred as eth5.   > show system state filter cfg.aux_intf.map cfg.aux_intf.map: { 'aux-1': eth5, 'aux-2': eth6, }   > show system state filter net.s0.eth5.* net.s0.eth5.cfg: { 'disable-dhcp': True, 'fips-gated': True, 'hwaddr': 08:66:1f:02:7d:e2, 'ifindex': 7, 'ip-type': static, 'mtu': 1500, 'onboot': True, 'routes': { 'default': , }, 'table': aux-1, 'v6routes': { 'default': , }, } net.s0.eth5.dhcp-dns: { } net.s0.eth5.dhcp-ntp: { } net.s0.eth5.dhcp-opcmd: 0 net.s0.eth5.dhcp-options: { } net.s0.eth5.hwcfg: { 'advertised': [ ], 'link': Down, 'mode': Force, 'setting': 1Gb/s-full, } net.s0.eth5.stats: { 'rx-bytes': 0, 'rx-compressed': 0, 'rx-drop': 0, 'rx-errs': 0, 'rx-fifo': 0, 'rx-frame': 0, 'rx-multicast': 0, 'rx-packets': 0, 'tx-bytes': 0, 'tx-carrier': 0, 'tx-colls': 0, 'tx-compressed': 0, 'tx-drop': 0, 'tx-errs': 0, 'tx-fifo': 0, 'tx-packets': 0, }   eth5 can be identified by Interface Index: 'ifindex': 7. By doing SNMP walk, I could see this interface to be showing up: I know this is not perfect answer to your question, but if your monitoring system can monitor 'ifindex': 7, the it should be possible to monitor this interafce.   Kind Regards Pavel       ... View more

Thank you for update @Muruganandham.SP    I am running in my environment the same setup where Passive Firewall is sending System logs to syslog server and I can confirm that I can see logs on server side, so this should be definitely working.   As next step to troubleshoot, I would advice to check detailed output from: less mp-log syslog-ng.log and take packet capture on management interface: tcpdump filter "port 514" (https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CleECAS).   Kind Regards Pavel ... View more