About BrianRa

Ryan,   Sorry I may have misunderstood your original question. Most things should be pushed from active to passive.  You will need to check if this portion of your config is being pushed. You should be able to configure your active firewall SNMP on management and if you are synchronizing this component of the management it should push over to the passive firewall.  If not duplicate the active firewall SNMP to the passive and in you SNMP server everything should be the same but the IP and the descriptor you are using.   Brian ... View more

Paul,   Personally I'm not sure what to tell you, this is the only article I found that may be of use to you. https://live.paloaltonetworks.com/t5/Management-Articles/Troubleshooting-GlobalProtect/ta-p/75770   Brian   [Edit] Maybe this isn't a PAN GP error but a Windows error. https://social.msdn.microsoft.com/Forums/vstudio/en-US/58e420e9-43a3-4119-b541-d18158038e36/tcp-error-code-10061-no-connection-could-be-made-because-the-target-machine-actively-refused-it?forum=wcf https://stackoverflow.com/questions/10307864/winsock-returns-10061-on-connect-only-to-localhost [/Edit] ... View more

@Mick_Ball's suggestion is the best option.  We are doing the same thing with our domain laptops.  This functions fairly well (occasionally a rediscover network is required as users just sleep thier computers between office and home).   Brian ... View more

Use this with caution.  I would decide how important the rule changes are in the immediate.  https://live.paloaltonetworks.com/t5/Management-Articles/Disable-Panorama-Policy-and-Objects-Disable-Device-and-Network/ta-p/76539 Once this is done it can be a pain to pull back into Panorama, we have had to do this for a site we were bringing online once and also when a site was no longer able to connect due to ISP changes.  Both times there were unique challenges bringing it back into Panorama.   Brian   Company note: we chose to run Panorama for configurations as a VM, we maintain a backup copy of it at a DR site incase there is an emergency/failure. ... View more

In our HA pair we do not do SNMP from the production IP address (only on the active firewall).  We use the management interfaces, each firewall management IP is unique.  (All configured through Device -> Setup)   Brian ... View more

If you are using Panorama to push configs you would need to log into that instead and run. Panorama> set cli config-output-format set Panorama> configure Panorama# show device-group MY_FIREWALL | match complexity This is the same result but if you push from Panorama the local firewall does not show those configs.  You would have to view them in the view not config mode and there is no output format option so it is all xml.   Brian ... View more

@mcjyrnn, we have found that the destination side doesn't really matter (as far as being allowed back, it is a solicited response at that point) as it is all based on the source User, Zone, IP.  Something you are filtering on does not match what the rule is configured for.  You can pull the rule from the CLI as well (I had to pull from Panorama as I push my rules).   Panorama> set cli config-output-format set Panorama> configure Panorama# show device-group MY_FIREWALL pre-rulebase security rules Global_ICMP set device-group MY_FIREWALL pre-rulebase security rules Global_ICMP profile-setting group MY_Strict_NO_URL set device-group MY_FIREWALL pre-rulebase security rules Global_ICMP target negate no set device-group MY_FIREWALL pre-rulebase security rules Global_ICMP to any set device-group MY_FIREWALL pre-rulebase security rules Global_ICMP from [ MY_ZONES ] set device-group MY_FIREWALL pre-rulebase security rules Global_ICMP source any set device-group MY_FIREWALL pre-rulebase security rules Global_ICMP destination any set device-group MY_FIREWALL pre-rulebase security rules Global_ICMP source-user any set device-group MY_FIREWALL pre-rulebase security rules Global_ICMP category any set device-group MY_FIREWALL pre-rulebase security rules Global_ICMP application [ icmp ipv6-icmp ping traceroute ] set device-group MY_FIREWALL pre-rulebase security rules Global_ICMP service application-default set device-group MY_FIREWALL pre-rulebase security rules Global_ICMP hip-profiles any set device-group MY_FIREWALL pre-rulebase security rules Global_ICMP action allow set device-group MY_FIREWALL pre-rulebase security rules Global_ICMP rule-type universal set device-group MY_FIREWALL pre-rulebase security rules Global_ICMP description "ICMP, Ping, Traceroute" set device-group MY_FIREWALL pre-rulebase security rules Global_ICMP log-setting MY_TRAFFIC_LOGS   A test you could do is set both source and destination Users, Zones, IPs to ANY.  Obviously this is not a long term fix but as a test it would let you know if ICMP in general is being caught by your rule.   Brian ... View more

Here is our global ICMP rule.  We specifically had to add traceroute as well.   Brian ... View more

Supposedly with the active on 7.1.x and the passive on 8.0.x you can tell them to fail over and the passive will pickup without any problems. ... View more

It is production, our SEs and support did not have any concerns with it when we have talked to them about it.  Panorama has run fine.  Remember we haven't done a firewall yet but I haven't been able to find any negatives posted.  If we do ours first before you I will update with anything we noticed.  This will be a remote site, we didn't want to tackle the VPN possible problems and the major revision update at the same time first as we have this option.   Brian ... View more

@JohPalmer  FYI if you plan on being able to synchronize between the two firewalls you will need to move them both to 7.1.x before upgrading them to 8.0.x.  They will not synchronize 2 revisions down, only 1.  We asked support about this and that is what they told us. Your path should be 7.0.11 -> 7.1.0 -> 8.0.0 ->  8.0.5  (we were recommended by our SEs to go to 8.0.7, Panorama has not had a problem with this but we have not moved our firewalls yet.).   Brian ... View more

Based on what support is saying and what we have been reading that install order looks correct.  That is what we will be doing next week when we upgrade our first PA-3020 (only to the 8.0.7).   This is the email we received. PAN-SA-2017-0030 - Cross Site Scripting in PAN-OS GlobalProtect  * Medium Severity * Fixed in PAN-OS 6.1.19, PAN-OS 7.0.19, PAN-OS 7.1.14, PAN-OS 8.0.6-h3 * Affects PAN-OS GlobalProtect portal and gateway * CVE-2017-15941 PAN-SA-2017-0031 - Cross Site Scripting in PAN-OS Captive Portal * Medium Severity * Fixed in PAN-OS 8.0.7  * Affects PAN-OS captive portal * CVE-2017-16878 PAN-SA-2017-0032 - ROBOT attack against PAN-OS * High Severity * Fixed in 8.0.7 * Affects PAN-OS SSL/Decryption and GlobalProtect portal and gateway * CVE-2017-17841 ... View more

Another note.  We upgraded our Panorama to 8.0.7 and did not  have any problems.  We did this based on a security release that was fixed in 8.0.7 and was recommended by our SEs. https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os-release-notes/pan-os-8-0-7-addressed-issues#_49938 Another thing we are finding out right now based on a support ticket is that from our current 7.1.10 there is a bug going to 8.0.x that Panorama will blow out the VPN configurations unless your firewalls are on 7.1.15. ... View more

@jsalmanswe had a similar experience.  We started stacking/nesting them right off the bat and ended up deleting everything and just making a default template concept to copy. @sam_millerI do agree they work differenty.  With Template stacks the config priority goes to the farthest down the chain.  Device Groups are the opposite in the sense that whatever is configured Globaly takes priority.   Another interesting thing to note is that the Device Groups and Templates are developed by different groups.  I would guess the Device Group developers are more of the CheckPoint experienced devs and the Template group are more the Juniper devs. ... View more

I don't have a lot to add but we looked into this as well as we are A/P with ours HA pair.  The firewalls in 7.1.x and 8.0.x will still synchronize after one is upgraded and rebooted, anything older (7.0.x etc) will not synchronize.   Brian ... View more