About PavelK

Thank you for reply @Kai_Ulrich and sorry for getting back to you with delay.   I was trying to reproduce the issue you are facing, however in all my attempts using exactly the same scenario it was working as expected. Based on your screen shots and description you provided it looks like there is no misconfiguration. I would advice to open a ticket to TAC or to your Palo Alto partner if you have such option.   Kind Regards Pavel ... View more

Thank you for reply @rkbalaguru  and sorry for getting back to you with delay.   Based on how I interpret your requirement, I would configure following 2 NAT policies. This would be private subnet to private subnet translation between Azure and Onpremise.   Source NAT:     Destination NAT:     An alternative would be a Dynamic NAT + PAT to interface:     Kind Regards Pavel ... View more

Thank you for reply @Tyson-Liu  and sorry for getting back to you with delay.   I know you mentioned that you can't reproduce it, however if you come across similar case for different signature as a next action I would recommend to get a session ID and then from CLI issue: show session id <session id> | match count   You will get below output:   total byte count(c2s) :  total byte count(s2c) :  layer7 packet count(c2s) :  layer7 packet count(s2c) :    If you can by re-running this command still see bytes increasing, it is possible that for c2s, the infected client is still sending some traffic hitting this signature.   Kind Regards Pavel ... View more

Thank you for reply @Joe_Ng    I see. If you believe there is a URL mis-categorization, you can submit a request from this link: https://urlfiltering.paloaltonetworks.com/ Other than what you are already doing with a manual whitelist, I can't think of any better way to avoid the issue you reported.   Kind Regards Pavel ... View more

Thank you for posting your questions @Mohamed_Haneef    1.) I assume that you are using Panorama with local Log Collector. Even though Panorama has Active and Passive status for management functions, the log collectors process incoming logs from Firewalls regardless of the Active / Passive status. Depending on how you configured Device Log Forwarding Preferences each of the Log Collector can be ingesting different logs, then if you configure Syslog under Collector Log Forwarding, you might be seeing that Log Collector running on Passive Panorama node might actually be sending more logs to 3rd party system than your Active Panorama node. You can verify current log rate status by going to: Panorama > Managed Collectors > Statistics > Performance (Average Logs/sec). If you in the future build dedicated Log Collector, then it will be dedicated Log Collector sending logs to 3rd party system and not Panorama Manager.   2.) To be honest, I never looked into this, but only for comparison I checked a few Log Collectors and I can also see: "syslog dropped count" is high, but in you case it does not sound healthy. Are you seeing anything unusual in the System Log? You can use filter: ( subtype eq syslog ).   3.) Could you go to: Panorama > Collector Groups > [Log Collector Name] > Log Storage > Detailed Firewall Logs and check your allocated quota? If you have unallocated space then try to increase it from unallocated space, otherwise try to reduce slightly quota from for example: "Summary Firewall Logs" or "Infrastructure and Audit Logs" and allocated it to: "Detailed Firewall Logs" to see it makes a difference.   Kind Regards Pavel ... View more

Thank you for posting question @larry2019    There might be different ways to do it, but probably most straightforward way is to configure new alert under: Device > Log Settings >  System   You can use for example following filter: ( subtype eq vpn ) and ( eventid eq tunnel-status-down ) and set email profile for alerting.     Kind Regards Pavel     ... View more

Thank you for your post @Joe_Ng    Palo Alto's recommendation is to exclude whole URL category: "financial-services" https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/decryption/decryption-exclusions/create-a-policy-based-decryption-exclusion.html This should cover sites that you get redirected to for online payments.   Kind Regards Pavel ... View more

Thank you for posting question @omarbatis   I had the same issue and could not find any way to do it by CLI. I ended up opening a ticket to TAC. Unfortunately, the answer was it is not possible to provision a device certificate for log collector. Unless they came up with a new feature in future releases to do it, you will have to ignore warning about missing certificate.   Kind Regards Pavel ... View more

Thank you for sharing @zinkt101   After your last post, I was running out of ideas. It is good that you could eventually solve it by downgrading. ... View more

Thank you for posting question @OsamaKhan    We are currently in the process of migration to IPv6. Regarding your question, there is no pre-requisite. The Dual Stack configuration is fairly straightforward. You will have to enabled IPv6 on interface and configure its IPv6 address, then configure routing for IPv6. After these steps, your IPv6 WAN address should get hit by traffic.   We came across a few points: - Any issue to IPv6 BGP peering also affects IPv4 BGP peering. - When you configure security policy for IPv6, there is no "any6" object, so all your existing policies that already have "any" will depending on configuration allow or deny IPv4 as well as IPv6 traffic. Somebody in this community found workaround for this: https://live.paloaltonetworks.com/t5/general-topics/create-a-any-ipv6-address-object/td-p/26454   Other than this we did not encounter any major issue.   Kind Regards Pavel ... View more

Thank you for reply @zinkt101   Before you start migration, could you set the download schedule of Wildfire to: "None" on both Firewalls, then start with migration over? If it succeed, then after migration you can change Wildfire scheduler from Panorama via Template.   Kind Regards Pavel ... View more

Thank you for your post @zinkt101    Would it be possible to provide details of commit fail message? Typically there is description what prevented commit to succeed.   Thank you Pavel ... View more

Thank you for posting question @Tulasi    The event you are referring to is recorded in the NetFlow Template, Value: 233 (firewallEvent) 3 = Flow denied—The NetFlow data record indicates a flow that firewall policy denied. https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/monitoring/netflow-monitoring/netflow-templates.html I was searching myself whether there is any way to exclude some flows or build a custom NetFlow Template to exclude some of the values, but I have not found any option to configure it directly on Firewall. Unless you can exclude it on NetFlow Collector/Analyzer side, there is likely no option to do it. I know that with some NetFlow Analyzers it is possible to filter view to exclude some hosts or subnets.   Kind Regards Pavel     ... View more