About Phoenix

Hi, Another way of looking at live traffic utilization on interface is to set the QOS for that interface( only to see live stats ) and pass all traffic through class 4 ( default traffic ) and set the interface Bandwidth value to the max and guaranteed values. Once traffic is passing we can see the live statistics graph on the PAN itself. For reference: https://live.paloaltonetworks.com/docs/DOC-3158 ... View more

If the concern is to make sure that if PAN has identified a new app which you are using already but identified till now as "web-browsing" and after the new App updates it is found as a new app, it is natural to lose them as the rules would not permit them. The best way to avoid this is to check our APP updates ( Application and Threat Content Release Notes ) mail which share all the applications details Modified apps, newly added Apps and app decoder changes and so on. If there is something pertaining to your requirement is addressed you can check your rules and edit them if needed to pass the traffic before any content updates are made. ... View more

I would not general see an issue with wildfire enabled having the tcp packet errors. Are the Tcp packet errors seen from the management interface on pan firewall to the wildfire cloud servers ? Or were these errors seen for data traffic passing through the Untrust interface. ... View more

Here is a sample where I could get the details from the report. Yes we do see some *.google.com but we also see talk.google.com and mail.google.com and drive.google.com if it is a well known links if not we get to see the *.google.com. This is snapshot from a user activity report with detailed web browsing activity. ... View more

May be we need more details when you say load balancing on what is the end goal. Are you looking at splitting the interface to be used for multi traffic like Sub-interfaces ? ... View more

Yes Panos is right. There is no option to reset password once lost. We will have to build it up from factory reset. ... View more

Hardware reference guide can be found for each hardware platform In the support site: https://live.paloaltonetworks.com/community/documentation Look for Hardware guides and select for your platform. LED ALARM: Red = There is a hardware failure, which may include power supply detected  but not working, fan failure, Hard drive failure, HA failover, or  temperature above high temperature threshold. If its Off then all is good. > Yes 90% is the value of the total percentage for X database ( where X can be Traffic, threat and so on ) > For CPU reaching 90% I do not remember any alarm but we have other logs to look for information. "tail dp-log dpmonitor.log" > For Temperature: LED indication is the best to look for. Operating temperature range 0° to 40° C. Storage temperature range -20° to 70° C. Humidity 5% to 90% non-condensing. System air flow Side to side. ... View more

Here is the image below explaining the Alarm is enabled for the specific log database when they exceed the percentage set. Here it is 90 default, this value can be surely altered @ Device tab > Alarms For temperature, if they exceed the device range of accepted temperature per the particular hardware guide then we should see an alarm. For Fan failure, if the fan fails an alarm is generated. This can be verified to see, " show system state | match chassis" Explains if Alarm is true if something is failed. ... View more

Hello, Per the Service route feature, we have 2 sections. In the left section > there are predefined features and an option to select the interfaces to tell the traffic to go through which interface out on the PAN. On the right section it is more generic. All you have to do is select the source as same interface IP address if you need the traffic to go out and receive on same interface and give the destination unique IPs for what the destination it is. Service route is means of telling take a different path ( interface other than management ) for certain destination IPs. Thanks Samshodh ... View more

Hello, Would it be the same time for partial and full commits ? I would  suggest opening a case with support so that we can direct the attention from the right team. More than a feature request we will have to identify what process in the code which is consuming or needing resources. Thanks Samshodh ... View more

Hi, Seeing the latest comment I find that you do not want to see the alarms. You can clear the alarms. Device Tab > Log Settings > Manage Logs > Clear Alarm Logs. To view the logs before clearing you can see @ Monitor tab > Logs > Alarms. The settings for the Alarms are done @ Device tab > Log setting > Alarms. Here is an option to change thresholds or enable or disable alarms. Hope this helps. ... View more

Hi, Looking at the primary requirement that you would like to see the real internet traffic and not see the traffic when backup takes place as this is causing to consume a lot of bandwidth. > One method is to have a security rule for backup traffic for servers but do not log them( Each security policy has log at session end which can be disabled). This makes sure that the PA 200 inline will have logs only for real internet traffic and you can monitor it. But the fact is backup server traffic is flowing through the same untrust interface. If the monitoring is done by external device other than PAN then we have to make changes on that device not to see back up traffic. Hope this makes sense. ... View more

Hi Mike, I have a same scenario with the 5000 platform. Can you please give me the details for the limitations: Error: Number of dynamic-ip-and-port rules (401) exceeds vsys capacity (400) I see the command above gives us a general perception of max limitations on box. For NAT this is what I see, cfg.general.max-nat-policy-rule Thanks Samshodh ... View more