About gwesson

TAC won't be able to help here I'm afraid. If it's not the exact models sold by PAN, it may work but may not. Support will not check compatibility of transceivers that aren't sold by Palo Alto Networks. The official 3rd party policy is here: https://www.paloaltonetworks.com/services/support/support-policies/third-party-components-support   As for the question regarding whether 8.0.6 contains the fix, it does not. You can always look at the release notes for any version to see fixes up-to and including that version. In this instance, the links at the bottom of the Upgrade/Downgrade block that @PaulBrock linked to show the transceiver issue mentioned as PAN-92564. That issue ID is a known issue in 8.1.0 and the latest version of 8.0 (8.0.8). Since it is in the "known issue" section it does not yet have a fix available. When a known issue is fixed, future release notes show what version contains that fix in both the Known Issues section and the Issues Resolved in this Release section.   Regarding the reboot question, the caveat listed is "Additionally, after we provide a release with this fix and you begin the upgrade process, you must not reboot the firewall after you download and install the PAN-OS 8.0 base image until after you download and install the maintenance release with this fix."    What that means is when you do decide to upgrade from 7.1 to 8.0, you just need to download the 8.0.1 base image but NOT reboot. Instead, download the version that contains the fix (whatever version that ends up being) immediately after downloading 8.0.1. Then reboot to the fixed version.   Hopefully this clarifies things a bit! -Greg Wesson ... View more

Looks like you were already pretty close, you needed to escape the pipe. This seems to work for me:     show system state | match debug.[glp]\|monitor.detail.enable     More broadly, you could probably use although it gets a bit unwieldy after enough entries.     show system state | match debug.g\|debug.l\|debug.p\|monitor.detail.e     Good luck! Greg ... View more

Yep, it's called a U-Turn NAT here instead of hairpin, but it's the same concept. Here's a detailed write-up on how to set it up:   https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-U-Turn-NAT/ta-p/61889 ... View more

In that case, I don't know of anything that can get that granular. Even if you could get all the sessions for each user in a fairly short amount of time (a couple minutes, for example) it wouldn't be accurate by the time you were done. Especially if you have several users streaming HD video or downloading large files.   Reporting would probably get you a better sense of what's going on without the difficulties of getting a real-time snapshot.   If you still want that data, you may want to filter it further than just all sessions, maybe just get the sessions larger than x-bytes so you don't see all the tiny sessions you don't really care about. Think about how a typical web session will generate many DNS queries that are individual sessions but typically only 2 packets with almost no bytes. Use the "min-kb" filter to get the filtered data with more relevant info. ... View more