About CosminM

@zaidshaikh, Since you are using Panorama for configuration purposes, you should have on Panorama the same updates type that you have on your managed firewalls. If on managed firewalls you have panupv2-all-contents-xxxx, then you should have on Panorama also panupv2-all-contents-xxxx. ... View more

Hello @zaidshaikh ,   All-Apps - Includes new and updated application signatures. This update does not require any additional subscriptions, but it does require a valid maintenance/support contract. New application updates are published weekly. All-Content - Includes new and updated application and threat signatures. This update is available if you have a Threat Prevention subscription (and you get it instead of the Applications update). New Applications and Threats updates are published weekly.   Let's assume that on your Panorama you want to configure an exception for a false positive threat ID and to push on your managed firewall. If your Panorama doesn't have threat signatures database, then you will not be able to configure any exception based on thread id.   Also, it's recommended that the dynamic content update version on Panorama to not be greater then the same dynamic content type on the managed firewalls.   ... View more

Hello @Tim_Stephens ,   These log quotas can be customized on firewall and you will find it in Device > Setup > Management and click on Logging and Reporting Settings. The window shows the total space available on the firewall, along with the allocated and unallocated disk space. https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/monitoring/view-and-manage-logs/configure-log-storage-quotas-and-expiration-periods  ... View more

Hello, Please look bellow to see what checks are performed by the firewall when you activate "Spoofed IP address" and "Strict IP Address Check" in Zone Protection: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000004LnmCAE  ... View more

Without a valid support subscription you cannot make any upgrades. Unfortunately, for your end-of-sale model (PA-3200 series) you will not be able to obtain a valid support subscription. Secondary Market Policy  Hardware End-of-Life Dates    ... View more

Hi, You can check DHCP log file pan_dhcpd.log to see if there are any errors. The CLI command is: less mp-log pan_dhcpd.log or tail follow yes mp-log pan_dhcpd.log     ----> for real-time logs For more DHCP troubleshooting info, please look here: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HDXnCAO  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CldkCAC    ... View more

Hi, Maybe your ISP have configure the DHCP server not to release IP addresses for devices that are not sending also the hostname. Windows clients will always send the hostname as part of the DHCP request. Enable Send Hostname on your ethernet1/1 and try after. ... View more

Hello @shobeav , To renew your production devices you need only serial number of that devices. When the renew will be finish, then you will get your valid auth codes. ... View more

Hello @Shonne , I suggest you to talk with the local PANW representative the following scenario: - first renew your production subscription for 1 year (12/15/2023 - 12/14/2024) - second, before the above renew expire ask for device conversion from Production to LAB and get a new renew quote as a lab device   ... View more

Hello, The session statistic informations are store in dp-monitor.log. To see this log file you can use the CLI command "less mp-log dp-monitor.log" To search for a specific session parameter historical date, use commands like grep mp-log dp-monitor.log pattern "New connection establish rate:"  - for new connections per second evolution grep mp-log dp-monitor.log pattern "Number of allocated sessions:"   - for maximum concurrent session evolution   Depending on your firewall model, you may need to replace mp-log with dp-log on the above CLI commands. ... View more

Hello,   You can do the following: on "shared-template" create a LDAP Server profile and an Authentication Profile that use the LDAP Server Profile on "FW1-template" create a Authentication Profile but configuring only the minimum info needed to activate OK button. That means that you will create a Auth Profile with THE SAME NAME as the one create on "shared template" and select only type as LDAP. then on your "FW1-template" you can use it to authenticate admin users. when you add these two templates into your stack, it will MERGE both configs ... View more

Hello @Matheus-Reis This is expected behavior because your rule it's first evaluated and matched at the end of session setup phase (slow path), but at that moment any criteria based APP-ID or URL's are ignored. Packet Flow Sequence in PAN-OS   Any traffic using TCP/443 it will generate a HIT COUNT for that security rule and if you activate also Log at session start, then you will see it in Traffic Logs. For the same Session ID you will have in your traffic logs at least 2 records (start + end). ... View more

Hi @Vip.shokazhanov  If I understood correct, you need to configure a virtual wire. https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-networking-admin/configure-interfaces/virtual-w...  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000HAFRCA4&lang=en_US  ... View more

Hello @PA_nts  I suggest you to run a flow basic debuging: https://live.paloaltonetworks.com/t5/general-articles/tips-amp-tricks-flow-basic-debugging/ta-p/545999  ... View more