About CosminM

Hi @Fariq_Zaidi , If both firewalls has the same Dynamic Updates configuration, running on the same time and sync to peer is active, then one of the peers my be confuse and not to know what to install ... the file that download himself or the one received from the peer. In a HA scenario not all the firewall configuration elements are synchronize, and Dynamic Updates settings are not sync between peers. Reference: HA Synchronization   If you let sync to peer active, I recommend to configure different moments when your peers verify for content updates (10-15 minutes delay between firewalls). or you deactivate sync to peer from content updates and every peer will perform individual content updates checks. ... View more

Hello @SeanDeHarris , It's possible to send the logs from PA-410 to Strata Logging Service. You will need to acquire a Strata Logging Service license. Introduction to Strata Logging Service It's not mandatory to have also a Strata Cloud Manager license.   Even the firewall will send the logs to Strata Logging Service, you will not see the log on firewall GUI. To see the logs you need to go to Strata Logging Service portal. View Logs in Strata Logging Service ... View more

Hello @antoniocerasuolo  Please be aware that PA-410 has some limitations on local logging. PAN-175545 - https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-release-notes/limitations/limitations-in-pan-os... Another discussion: https://live.paloaltonetworks.com/t5/general-topics/pa-410-tabs-not-displaying-in-monitor-tab/td-p/4...   PA-410 is a great box if you are planning on logging to Panorama or Strata Logging Service. ... View more

Hi @antoniocerasuolo ,   The PA-220 it's an End-of-Sales model and the second market policy it saying that: "Devices that are currently end-of-sale cannot be re-certified. For our current end-of-life policy and listing of products, please see our End-of-Life Announcements." Hardware End-of-Life-Dates - Palo Alto Networks ... View more

Hello @A.Otsu , Since you are starting from 11.0.0 I recommend first to install the latest preferred version from 11.0.0 (i guess it's 11.0.4-h6, you can check that on the Customer Support Portal -> Updates for your device series) on both firewall and only after to go to 11.1.x as you describe. At this time there is no preferred version for 11.2.x but you find the updated info on:  Support PAN-OS Software Release Guidance . Do you have any special request to upgrade up to 11.2.x?   ... View more

Hello @A.Otsu ,   The Skip Software Version Upgrade is referring to "standalone devices or Panorama managed devices running PAN-OS 10.1 or a later release". For HA pair there is another statement saying that: "When HA peers are two or more feature releases apart, the firewall with the older release installed enters a suspended state with the message Peer version too old.". In the past the same page was more explicit, see this post: https://live.paloaltonetworks.com/t5/next-generation-firewall/upgrade-path-from-10-2-3-h14-to-11-1-4-h7/m-p/1220168 where I post the previous sentence about upgrading HA pair firewalls. Based on all of the above, my suggestion is first to bring both HA firewalls to the latest preferred version of 11.1.x and only after to proceed with upgrade on 11.2.5. ... View more

Hello @A.Alharbi095930 ,   The list of Broker VM compatibility matrix can be found here: Configure the Broker VM • Cortex XDR Prevent Administrator Guide • Palo Alto Networks documentation porta and Oracle Cloud Infrastructure (OCI) is not on that list.  ... View more

Hello @jin-soo.park  Could you please check what version for GlobalProtect Agent are you trying to run on your MacOS 10.15.7? Does this GlobalProtect Agent version it's in the compatibility list? (Where Can I Install the GlobalProtect App?) ... View more

Hello @watkfr    As @reaper mnetioned you can skip up to 3 version when you upgrade a individual firewall. "When upgrading HA firewalls across multiple feature PAN-OS releases, you must upgrade each HA peer to the same feature PAN-OS release on your upgrade path before continuing. For example, you are upgrading HA peers from PAN-OS 10.2 to PAN-OS 11.1. You must upgrade both HA peers to PAN-OS 11.0 before you can continue upgrading to the target PAN-OS 11.1 release. When HA peers are two or more feature releases apart, the firewall with the older release installed enters a suspended state with the message Peer version too old. " https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-upgrade/upgrade-pan-os/upgrade-the-firewall-pan-os/upgrade-an-ha-firewall-pair  So, according with the above statement from TECH DOCS, you will need first to upgrade both HA peers to 11.0.x and after that to 11.1.x.   If the firewall with older release enters to suspend state before the other peer to be fully functional, then you will have service interruption. Even PAN-OS 11.0 it's end of support, you still need to use it as transitional state.   1. download 11.0.0 2. download 11.0.4-h6 (the latest preferred release from 11.0) + install 3. reboot the first firewall 4. repeat steps 1-2 for second firewall and reboot second firewall 4. download 11.1.0 5. download 11.1.4-h7 (the latest preferred release from 11.1) + install 6. second reboot for first firewall 7. repeat steps 5-6 for second firewall 8. second reboot for the second firewall Each HA peer will have 2 reboots. ... View more

Hello @N.MANTUA  You can find all the steps of how to migrate a firewall HA pair to Panorama on the following link: https://docs.paloaltonetworks.com/panorama/11-1/panorama-admin/manage-firewalls/transition-a-firewall-to-panorama-management/migrate-a-firewall-ha-pair-to-panorama-management  ... View more

Hello @Felixcao  First I will make sure that your customer it's using a Dedicated Log Collector, or they have a Panorama appliance running in Panorama Mode. Panorama Models  If it's an appliance running in Panorama Mode, they just need to upgrade as any Panorama device thro Panorama > Dynamic Updates and Panorama > Software https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-upgrade/upgrade-panorama/install-content-and-software-updates-for-panorama/install-updates-for-panorama-with-internet-connection    If they have a Dedicated Log Collector, they should first troubleshoot the connectivity between Panorama and the Dedicated Log Collector https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000g1lGCAQ&lang=en_US    ... View more

Hello @alexandra , Every Palo Alto Networks customer can check the categories of a specific URL by entering the URL into a Test A Site, our URL lookup engine. If the customer consider a URL is incorrectly categorized, submit a category change request. Another option is to create a custom URL category to exclude particular websites from category-based enforcement. ... View more