About PavelK

PavelK · ‎09-17-2021

Thank you for posting question @RobertShawver I do not believe there is any consideration. Myself I have renamed Device Groups several times and did not come across any issue with the exception of one case when I run into below bug affecting PAN-OS 8.1 and 9.0: PAN-115354 (Fixed an issue on Panorama M-Series and virtual appliances where renaming a device group followed by a partial commit did not change the device group hierarchy as expected) Other than this it should work fine. Kind Regards Pavel

PavelK · ‎09-16-2021

Thank you for the post @Jody_Whitlock - Are you facing the same issue when you install application package to Firewall? - Could you take a packet capture from management interface (Assuming this interface is used for deployment) of Panorama to see Panorama is initiating the file upload? - Could you try to delete existing image that was downloaded in Panorama, then click: "Check Now", then download image again. Kind Regards Pavel

PavelK · ‎09-16-2021

Hi @Alpalo thank you for information. Would it be possible to check the output of: "show wildfire status" to see more details? Here is link for further troubleshooting tips: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000oMCYCA2&lang=en_US%E2%80%A9 Kind Regards Pavel

PavelK · ‎09-15-2021

Thank you for posting the question @patrussell Regardless of Panorama's PAN-OS version, the only available option is ingestion of Traps logs. If you are using Cortex, then there is a support for 3rd party vendor log ingestion. Kind Regards Pavel

PavelK · ‎09-15-2021

Thank you @Alpalo for posting question. To my knowledge this is not possible. Management interface is configured individually on each firewall and is not part of HA. Here is the list of items that are not HA synchronized, management interface is on the top of the list: https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/high-availability/reference-ha-synchronization/what-settings-dont-sync-in-activepassive-ha.html I know that some Firewalls for example Cisco ASA has management interface to be part of HA, then when there is a failover the management interface is also changed, however PA does not have this implementation. Can I ask for the reason why this is required? Thank you & Regards Pavel

PavelK · ‎09-15-2021

Thank you for quick reply @Nikko In the past time, I had one time experience that Time Zone mismatch was a root cause for not seeing logs on Panorama. This is reason why I sent you that link, however after you confirmed that it actually works in your deployment, I tried to reproduce it by changing Time Zone on one of my Firewall. The result is: logs are still being displayed in Panorama. To answer your question, I believe that log time stamp on Panorama side will be from Panorama's time. This is what I see in my case after I have configured different Time Zone on Firewall side. You can verify it from CLI. The below commands will show time of the logs when it is being sent to Panorama and received by Panorama. Firewall: show logging-status Panorama: show logging-status device <Firewall Serial Number> Kind Regards Pavel

PavelK · ‎09-15-2021

Thank you for posting question @Nikko In order for Panorama to display logs, the Panorama and Firewall sending log must have the same time. This means also the same time zone. Here is corresponding KB: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClXACA0 I hope this helps. Kind Regards Pavel

PavelK · ‎09-14-2021

Thank you for posting question @Alpalo Personally, I would suggest to suspend Firewall you will be working on by going to High Availability > Operational Commands > Suspend local device. I would also recommend to disable Preemption under: High Availability > General > Election Settings. This will give you a control which device will be active regardless of configured priority. Regarding checking after processing each step, I would recommend to go to CLI and issue: show high-availability interface <HA Interface Name>, then make sure you see bytes received and transmitted. By issuing this command multiple times, you will see statistics to be increasing for bytes received and transmitted to make sure basic connectivity is there. Note: HA configuration is not synchronized between Firewalls, so you will have to make sure that HA configuration is consistent across both Firewalls. Kind Regards Pavel

PavelK · ‎09-13-2021

Thank you for posting question @Jack45 There is no specific license to enable HA, however both firewalls should be running identical set of licenses (For example both Firewalls running TP, WF,... licenses). Here is a link for HA pre-requisites: https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/high-availability/set-up-activepassive-ha/prerequisites-for-activepassive-ha.html All what you have to do is to proceed with HA configuration on both of PA-220: https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-web-interface-help/device/device-high-availability/configure-ha-settings.html PA-220 does not have any dedicated HA ports, so you will have to use regular data plane ports. The rest is the same as documentation. If you get stuck with your HA configuration do not hesitate to post your issue here. Kind Regards Pavel

PavelK · ‎09-13-2021

Hello Everyone, today, I got an update from PAN TAC: ==================================================================================== I have made some research and can confirm similar cases with the same version PAN-OS version 9.1.11, You do not need to worry, as you suspected, it is a cosmetic issue and it has no effect on the Production device. More over, it doesn't happen in PAN-OS 10. ==================================================================================== Other than this, I did not get any further information so we will have to wait to see this is going to be fixed in future releases in 9.1.X. Kind Regards Pavel

PavelK · ‎09-13-2021

Thank you @epeeler for posting question. This is the default value in Cisco IOS: crypto ipsec security-association lifetime kilobytes 4608000 In order to change it, please go to configuration mode, then issue: crypto ipsec security-association lifetime kilobytes <2560-4294967295> Kind Regards Pavel

PavelK · ‎09-13-2021

Thank you @charles07 for posting question. The ultimate answer is no. The Cisco ISE posture module will only work with Cisco AnyConnect client. Unfortunately there is no integration support for 3d party vpn clients. This information is backed by my Cisco SE. You can still use ISE for authentication of Global Protect clients. If posture check by ISE is a must, then you will unfortunately have to go with AnyConnect. Kind Regards Pavel

PavelK · ‎09-13-2021

Thank you for posting question @Mohamed_Haneef The EDL is installed as a part of Antivirus Update. Could you navigate to: Panorama > Dynamic Updates > Antivirus, then after installation of Antivirus package all EDLs should be available. Kind Regards Pavel

PavelK · ‎09-11-2021

Thank you for quick reply @ChrisKarakostas I see. There might be other way around it, but probably the easiest one might be to configure your firewall to fetch IP addresses from EDL Hosting Service and configure this EDL as a destination in the policy you just created. Below links are covering more details: https://live.paloaltonetworks.com/t5/blogs/edl-hosting-service-helps-to-safely-enable-microsoft-365/ba-p/410972 https://docs.paloaltonetworks.com/resources/edl-hosting-service.html The actual process to configure it should be straight forward: 1. Import relevant certificates and configure EDL itself: https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/policy/use-an-external-dynamic-list-in-policy/configure-the-firewall-to-access-an-external-dynamic-list-from-the-edl-hosting-service/create-an-external-dynamic-list-using-the-edl-hosting-service.html#id846c30d3-765e-4e50-8466-90431d2c64b6 2. Add EDL to security policy as a destination and remove destination any. Kind Regards Pavel

PavelK · ‎09-11-2021

Sorry guys for not giving any update on this. Unfortunately, there is not much to share. 3 days ago, I got an update from TAC that they are observing this issue from multiple customers without seeing any impact on device functionality, however the root cause is still under internal investigation and they come back to me again next week. Kind Regards Pavel

Member Since	‎09-03-2021 06:13 AM
Date Last Visited	‎02-26-2026 01:27 PM
Posts	1,174
Total Likes Received	472

Online Status	Offline
Date Last Visited	‎02-26-2026 01:27 PM

About PavelK

Re: Failed logins from 127.0.0.1

Re: Palo Alto PAN-PA-220 setup at Satellite Location

Re: Assistance with LDAP Authentication

Re: From Template Stack Override

Re: Windows Update - automatic policy without manual address definition

Re: Prisma Access China - push config failed

Re: Prisma Access China - push config failed

Re: HSCI port - amber blinking LED on both primary and secondary devices (5445)

Re: Prefered version for IONS

Re: IoT Security

Re: end of life and support of Pa-410 device

Re: Assistance with LDAP Authentication

Re: Palo Alto PAN-PA-220 setup at Satellite Location

Re: How can I delete my account on Live community?

Re: IoT Security

Re: Failed logins from 127.0.0.1

Re: Prisma Access China - push config failed

Re: DHCP Relay over SDWAN issue

Re: Does User ID Agent 10.2.4 compatible with PAN OS 11.1.13?

Re: Strange Gateway change issue on network with Prisma Access GP Client

Nominated Discussion: Palo Alto Networks Integration with Azure Sentinel

Nominated Discussion: Syslog Forwarding Issue

Nominated Discussion: Dynamically Update Microsoft Office URLs and IPs

Re: Renaming Device Groups

Re: Update Remote Firewalls from Panorama Fails

Re: Wildfire Events "failed to establish or resume a secure session"

Re: Panorama ingestion from syslog

Re: IP for Cluster HA Active Pasive

Re: Panorama and Firewall in Different Timezones

Re: Panorama and Firewall in Different Timezones

Re: HA Link and Path Monitoring

Re: PA-220 HA - License Required?

Re: Error on generating system logs

Re: IPSEC vpn between cisco 2900 and PAN

Re: Globalprotect with Cisco ISE

Re: Malicious IP addresses and High Risk IP addresses objects are not listed in Panorama

Re: Active directory OU as selection for users security policy

Re: Error on generating system logs

Nebula Beta

Unlock your full community experience!

About PavelK