About apasupulati

So does it list the directory as empty when you run >view-pcap filter-pcap <pcap file> ? The device is running into a previously reported bug, you can restart the vardata-receiver as a workaround for the issue: >debug software restart vardata-receiver Restart of this process should not affect the Dataplane or traffic traversing the firewall. Thanks, Aditi ... View more

Hi, What you're doing will work, but you don't have to do an application override for this traffic. You can just configure a security policy, with application set to 'any' or 'custom-app' and define the service ports to allow this traffic through. By doing so you can also add security profiles to the traffic to enable inspection. app-override will not perform any scanning on the traffic and this can cause threat especially if the traffic is to/from Internet. Refer: Does application override adversely affect Threat ID? Hope that helps, Aditi ... View more

Hello, Yes, the User-ID collector firewall will pass on the user-ip-mappings(incl. captive portal & global protect). On the collector you will see the GP ip-mappings as learnt from UIA instead of GP. Refer: GlobalProtect Users Appear as Coming From User-ID Agent in IP-User Mapping How to Configure and Verify User-ID Collector in PAN-OS 5.0 Hope that helps, Aditi ... View more

Hello kpv, So I understand from your description that only the Branch location network is inaccessible by the GP users. Do you have, 1. Proxy Id for the GP subnet and remote subnet (if doing a policy based ipsec vpn) 2. Security policy from GP-tunnel zone to the Ipsec-tunnel zone on the PA500. 3. Return route/access from branch network to the GP subnet on the Peer side. Thanks, Aditi ... View more

You should be able to export the config from the Panorama VM and import it to the M-100 with no issues. Configuration like the Collector groups, managed collectors, preference lists may need to be configured after loading the VM's config to the M100 for log forwarding. 1.Save and export the Panorama VM config 2. You may edit the device IP address and hostname on the xml file and import this to the M100. 3. Load the imported config file to the M100 and commit. 4. Configure Managed log collectors and Log collector groups for log forwarding from devices. Once migration is complete, configure the firewalls to point to the M100 for log forwarding. Please refer to the below articles as well: https://live.paloaltonetworks.com/docs/DOC-5057 https://live.paloaltonetworks.com/docs/DOC-4207 ... View more

As you can see from the log details, the session start time was at 10:42 and you have the log option set to log at session end (Type: end), log generated time: 12:09. So as pointed out by Anon, these might be the old sessions which timed out much later and a log was generated at session end. Thanks, Aditi ... View more