About emr_1

It depends on your configuration of... -split tunneling -security rule (especially for DNS, HTTP, HTTPS in this case) -nat rule (from GP tunnel to internet)   Please look at your config and logs, and find out how is your traffic is handling by PA device. ... View more

If you are currently using "External Gateway (auto discovery)" mode which described in following url: https://docs.paloaltonetworks.com/globalprotect/10-1/globalprotect-admin/globalprotect-gateways you can use manual mode instead.   After configuration, on user side, he/she can select which gateway to connect. ... View more

https://status.paloaltonetworks.com/incidents/d3bs717c7yq8   Even this information is for prisma access, you might find the hints. If you are using decryption rules, bypass rule might help you. ... View more

At least you need to take care of two locations.   One is DNS proxy as mentioned in previous post:     Secondary, you need to configure to use dns proxy by system (pan device itself) as below:     Here is my result: ==== admin@PA-455> ping host abcsampledomain.com  <<< Before configuring above two ping: abcsampledomain.com: System error admin@PA-455> show dns-proxy static-entries all Name: dnsproxy Static Entries: 2 Domain IP/Name Type Class TTL Hits Static ----------------------------------------------------------------------------------------------------------------------------- 4.3.2.1.in-addr.arpa abcsampledomain.com PTR IN 0 0 config abcsampledomain.com 1.2.3.4 A IN 0 0 config admin@PA-455> ping host abcsampledomain.com <<< After configuring above two PING abcsampledomain.com (1.2.3.4) 56(84) bytes of data. <<< you can see IP address ====   ... View more

You can see currently installed version which is not preferred if you uncheck both boxes at bottom. Here is sample from my testbed:       After uncheck.... ... View more

Even I don't see such issue, if I can't find why and who uninstall GP app, I would protect it from uninstallation by password: https://docs.paloaltonetworks.com/globalprotect/5-1/globalprotect-app-new-features/new-features-released-in-gp-app/uninstall-option-globalprotect-windows   To try to figure out who uninstall GP app, you might able to find any hint from event viewer. FYI: https://www.prajwaldesai.com/find-who-uninstalled-application-from-server/     ... View more

From the keyword "pre rules", I guess you are using Panorama, and also you are configuring new security rule directly to PAN device (PA-xxx). If so, you need to configure new rule on panorama, not on PAN device. Here is brief diagram how security rule works when you are using panorama.           In addition to above, you can't add/edit/delete rules which are pushed from panorama on PAN device.   Hope this helps you. ... View more

Just wondering it is not caused by GP because I can see some post outside the palo alto https://www.google.com/search?q=18.2+mail+problem I would recommend you to narrow down little more. ... View more

If my understanding is correct, you can't create new legacy mode with latest pan-os. If you need lagacy mode environment, I believe you need to prepare very old image with lagacy mode and then keep upgrading it 'til the latest. https://docs.paloaltonetworks.com/panorama/11-1/panorama-admin/panorama-overview/panorama-models Legacy mode ( ESXi and vCloud Air only )—In this mode, the Panorama virtual appliance receives and stores firewall logs without using a local Log Collector (see Deploy Panorama Virtual Appliances in Legacy Mode with Local Log Collection). By default, the virtual appliance in Legacy mode has one disk partition for all data. Approximately 11GB of the partition is allocated to log storage. If you need more local log storage, you can add one virtual disk of up to 8TB on ESXi 5.5 and later versions or on vCloud Air. Earlier ESXi versions support one virtual disk of up to 2TB. If you need more than 8TB, you can mount the virtual appliance in Legacy mode to an NFS datastore but only on the ESXi server, not in vCloud Air. This mode is only available if your Panorama virtual appliance is in Legacy mode on upgrade to PAN-OS 10.0. On upgrade to PAN-OS 9.0 and later releases, Legacy mode is no longer available if you change to any other mode. If you change your Panorama virtual appliance from Legacy mode to one of the available modes, you will no longer be able to change back into Legacy mode.     ... View more

> configure # delete rulebase security rules "TESTING2" log-setting ... View more

I believe sonicwall is not supported. It's not in this list: https://live.paloaltonetworks.com/t5/expedition-articles/expedition-supported-3rd-party-vendor-matrix/ta-p/336922 ... View more

You can customize log format. Even there is no document for recent version, refer to 10.0 is enough to understand. FYI: https://docs.paloaltonetworks.com/resources/cef   For each log field, another doc is useful. https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions   ... View more

Oh,okay...then you don't need this license. Just delete it from CLI   First, type in question mark to list all license files on your platform delete license key ?   Then type in specific file name delete license key <name>     Sample: ==== > delete license key ?   GlobalProtect_Gateway_2024_05_31.key 2024/08/01 01:57:21 0.3K Logging_Service_2022_08_09.key 2023/12/19 15:52:21 0.3K PAN_DB_URL_Filtering_2023_05_18.key 2023/12/19 15:52:21 0.3K   > delete license key Logging_Service_2022_08_09.key ==== ... View more

You mean even you are not purchasing Logging Service, your platform has Logging Service license?   If you are surely you are not using Logging Service, you can ignore it. (but you will keep receiving alert everyday)   If you are using Logging Service for other service, for example; you have Prisma Access, activated Logging Service license will be applied to all devices under same CSP. You need to check internally.   If your devices are under control of ASC (Authorized Support Center), ask them. Possibly ASC mistakenly activate their Logging Service and applies to your devices (same logic as above) ... View more