About rmonvon

Hi...Yes, you can use those methods with 2 PAs in HA.  You just need to make sure the 2 PAs are connected to both ISPs using the same Ethernet ports so that when a failover occurs, the active PA can reach the 2 ISPs.   ... View more

Hi...Do you have address group(s) that is using those tags?  The tags themselves don't contain the IP values, and the address group(s) will be populated with the IPs via the tags.     https://live.paloaltonetworks.com/t5/Documentation-Articles/Dynamic-Address-Objects/ta-p/61300 ... View more

Hi...HA is a system-wide setting and will apply to all VSYS on the pair of PAs.  So all VSYS will be A/A or A/P HA and share the same HA settings.   Thanks, ... View more

yes, a quick search on 'l3 sub' has several useful results.  Here's one:   https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Create-Tagged-Sub-Interfaces/ta-p/58712   ... View more

Hi...Typically, you want to run the agent at the same or lower version than your PA firewalls.  Since the lowest PAN-OS you mentioned is 7.0.2, I would recommend running the agent at version 7.0.2-2.       Thanks. ... View more

Hi...The port mirroring capability of the PA is for decrypted traffic only, and does not include non-decrypted traffic.  For example, SSL traffic can be decrypted by the PA and the contents inside the SSL tunnel can be forwarded out an Eth port set up as port mirroring.  Here's more info on port mirroring:   https://www.paloaltonetworks.com/documentation/60/pan-os/pan-os/decryption/configure-decryption-port-mirroring   If you want to span all traffic, it's best to do it at your switch.     Thanks. ... View more

Hi...I assume your case is to allow Internet users to connect to your web server in the DMZ and the server will be assigned a private IP address.  Please checkout the section 'Destination NAT' in this NAT document which has an example of the NAT & security rules:    https://live.paloaltonetworks.com/t5/Documentation-Articles/Understanding-PAN-OS-NAT/ta-p/60965   The basic config is to define the inbound dest NAT rule to translate the public IP to the private IP, and the security policy rule to allow the specific app/traffic to the web server.   Optionally, you can also define DoS protection rule to protect the server from possible DoS attacks.   Thanks,   ... View more

1st you will need to manually enable Multi-VSYS on the passive.  Then if the VSYS'es are defined locally on active PA, you can perform an HA sync and the configuration of the VSYS will sync to the passive.  If you are using template in Panorama to define the VSYS'es, then you need to perform a template commit to push the VSYS config to the passive.   Hope that helps. ... View more

With multi VSYS running, each VSYS is considered to be a firewall by Panorama.  For example, we have 5 VSYS'es defined and Panorama will detect 5 firewall instances (10 firewall instances in the case of HA).  Typically, we will define 5 device groups, 1 group for each VSYS with a pair of A/P firewalls in each group.    You will need to to commit to the passive to push the objects from Panorama.  Panorama commits are not sync to give us the flexibility to commit to 1 PA or to both.  Also, there is no VSYS sync but rather the sync is done with HA process.  ... View more

I just want to confirm that we are talking about Panorama (not the PA firewall) running on VM platform.  Panorama will need a serial number and the serial number is provided in the email of the order.  If you purchased Panorama & registered it, then the S/N can be obtained via your support portal under Assets.   See reference in the manual 'For the Panorama virtual appliance, the serial number was included in the order fulfillment email.' :   https://www.paloaltonetworks.com/documentation/60/panorama/panorama_adminguide/set-up-panorama/install-licenses    Once you have the S/N, you enter the S/N into Panorama under General Settings:   ... View more

Since both PAs are running with the same config, you may try sync'ing from passive to active device.  Also, your log does not show the same error as mentioned in this link, but restarting the management server may resolve the issue:    https://live.paloaltonetworks.com/t5/Management-Articles/Cannot-Sync-from-Active-to-Passive-Member-in-HA-Pair/ta-p/61345 ... View more

That document is describing the license for the VM firewall which will require UUID and CPUID.  For Panorama VM, the management system, the license is administered via its serial number.   ... View more

I would create a new address object. ... View more