About emr_1

One is to use "config audit". It is under Setup tab This gives you to compare two configurations.   Second option is to use any tools you want to after exporting rules by csv format. I think this is the best way.   At last, you can't use report feature (under Monitor tab) on PAN-OS to compare rules (configuration) ... View more

You can ask PAN for tracking PAN-189587. PAN recognizes this issue and trying to fix it, but it's not fixed yet. This issue should be seen with PA-400 series and the fix is needed not only on PAN-OS level but also BIOS level as I heard. ... View more

Do following URLs help you?   https://docs.paloaltonetworks.com/vm-series/9-1/vm-series-deployment/license-the-vm-series-firewall/software-ngfw/migrate-to-a-flexible-vm-series-license   https://live.paloaltonetworks.com/t5/general-topics/convert-vm-series-perpetual-to-flexible-license-credits/td-p/433981   ... View more

@reaper  Thank you, I understood that.   @Raido_Rattameister  The articles I know is only this one (except legacy platforms): https://www.paloaltonetworks.com/resources/pa-series-next-generation-firewalls-hardware-architectures For more details, I believe that would be internal. ... View more

If I hear combination of "404 NOT found" and "Global Protect", then I'll look at configuration of Portal Login Page, described as below. If you configure it as "disable", then portal page responds with 404 NOT found ... View more

step2,3,4 are direct access to IdP ... View more

GP Agent (=workstation) needs direct access to AzureAD. Here is good explanation with diagram: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm2oCAC   At first, the global protect user needs to access to prisma access (flow number 1 in diagram) Then prisma access redirects user to SSO (number 2) The user will access to SSO (number 3 ..... and this is answer for you) ... View more

Here is compatiblity matrix: https://docs.paloaltonetworks.com/compatibility-matrix/supported-os-releases-by-model/palo-alto-networks-next-gen-firewalls   You can find the cell which is crossed by "PA-800 Series Firewalls" and "PAN-OS 10.1" as check marked, which means you can use your PA-820 with 10.1.9-h1 [DeepL translate for you: to Spanish] Aquí está la matriz de compatibilidad: https://docs.paloaltonetworks.com/compatibility-matrix/supported-os-releases-by-model/palo-alto-networks-next-gen-firewalls   Puede encontrar la celda que está cruzada por "PA-800 Series Firewalls" y "PAN-OS 10.1" como marcada, lo que significa que puede usar su PA-820 con 10.1.9-h1 ... View more

PAN device automatically fetch the latest license within 30 days before it expires, if your device has more than 30 days, it does not sync-up. The timing which kicks sync-up process is at approximately 4am, you can see similar logs as below: License for feature threat expired on YYYY/MM/DD License for feature url-filtering expired on YYYY/MM/DD   At last, here is brief knowledge of renewal license: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClihCAC ... View more

Hi I found following article in Knowledge base. The answer for your second question seems to be this. If so, check out your running PAN-OS version and try to upgrade it. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000wlTVCAY   ... View more

As you are writing down "openssl" as a phash generator, I believe most of users can do that on their computer. Here is one example: I used my Windows 10 machine with ubuntu on it (ubuntu was installed by WSL)   c:\>ubuntu root@MyWindows:~# openssl passwd -5 -salt sampleSALT Password123 $5$sampleSALT$g.faXa7FXwSPDL6dW6fkoNQt7kueN/yfSV3moRtUxE6   On PA device: Configure new admin user with phash which I generated on the above   admin@PA-VM_OS10(active)# set mgt-config users sampleadmin permissions role-based superuser yes [edit] admin@PA-VM_OS10(active)# set mgt-config users sampleadmin phash $5$sampleSALT$g.faXa7FXwSPDL6dW6fkoNQt7kueN/yfSV3moRtUxE6 [edit] admin@PA-VM_OS10(active)# commit Commit job 159 is in progress. Use Ctrl+C to return to command prompt ..........55%.70%98%.................100% Configuration committed successfully     To test this new admin: Number of failed attempts since last successful login: 0    sampleadmin@PA-VM_OS10(active)> show admins Admin From Client Session-start Idle-for Session-expiry --------------------------------------------------------------------------------------------- * sampleadmin 172.30.10.22 CLI 03/09 13:16:31 00:00:00s 04/08 13:16:31 sampleadmin@PA-VM_OS10(active)> sampleadmin@PA-VM_OS10(active)> configure Entering configuration mode [edit] sampleadmin@PA-VM_OS10(active)# show mgt-config users sampleadmin sampleadmin { permissions { role-based { superuser yes; } } phash $5$sampleSALT$g.faXa7FXwSPDL6dW6fkoNQt7kueN/yfSV3moRtUxE6; } [edit] sampleadmin@PA-VM_OS10(active)# ... View more

You don't need to "deselect and commit". Just change cert and commit will work (at least worked on my lab / pan-os 10.1.6-h6) ... View more