About Brandon_Wertz

@RobertShawver wrote: Is there a way to find out how many count against the max?  show system state | match cfg.general.max-address That will tell you that the max is 10000, but how can I find the number counting against that 10000? Can't you just look at the UI of that object group?  It will tell you what the count is.  Or platform object count are you looking to see your limits on? ... View more

@Al-Zuhri wrote: Hi,   How can we know the frequency release version of PAN OS? Or just wait for new info on software release guidance eg version 10.1.14-h8 Version Represents Frequency 10 Major Version   1 Minor Version   14 Maintenance   H8 hotfix (urgent fix on introduce issued)     Thanks in advance! In the past there was a loose cadence of ~every 6 weeks for a "minor" / "patched" / "X" (a.b.X) release.   It's my understanding that "a" and "b" positions Palo considers them major releases where new features are released.  Typically the first or "a" release happens every 2-4 years and a "b" release ~ every 2 years.  Like Radio mentioned though, there's been a lot of churn from a firmware cadence in the past 3 years so the above hasn't really tracked. ... View more

@soporteseguridad wrote: hi,   Yes I know that but I do not want that what I want is that when it reaches 80% that is configured by default I get an alert by email I want to change from 80% to 90% so that I only get the alert when it exceeds 90%.   Kind regards Don't think there's an option to do what you're looking to do on the box.  Best bet is to open a support case or talk to your SE and see if it's something that can be added as a feature request. ... View more

@mike.molyneux wrote: Hi.   I'm trying to setup alerting for multiple elements of the Palo Alto firewall, one thing I've not been able to work out is how the get alerts for when the Dynamic updates aren't working and the same with the URL DB. So I can be made aware if the updates haven't updated in xxx days. They're on a schedule to download and install, but would be nice to know if there's a way of being alerted if they're not being applied for some reason.   Not sure if this gets written to the system log in any way? Or any other ideas?   Thanks   I've not found a way to do it from the device system logs, but it's really easy to setup in AIOps (the free version) which is what we have.  Within AIOps you can setup email notification alerts that look like this.  You can also see we've setup notifications for other device function/issues:       ... View more

@JeanPaul222 wrote: Could you update me please? I am unable to escalate. You're unable to "escalate?"  You have a support case open and TAC isn't working with you?  Based on your original post it looks like your firewall is having issues communicating with Palo's support portal given you have messages for multiple dynamic content packages not receiving updates.  I would ensure the firewall has connectivity to the Internet, or open a support case like the error messages suggest. ... View more

@Ismailsh wrote: I am setting up a lan to lan tunnel between my palo alto firewall and another palo alto device.  When I look at the documentation online, they suggest I create a new zone and set the type to "layer3".  But I also see a type "Tunnel" in there.  I would like to understand , should I select Tunnel or Layer3 for the zone that will be applied to the VPN tunnel?   Below are the documents I have read from Palo Alto.  I would like to ask what have you selected as the zone type and why for VPN tunnel.   https://live.paloaltonetworks.com/t5/next-generation-firewall/zone-types-interface-types-tap-mode-virtual-wire-firewall/td-p/548416   https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGkCAK   https://docs.paloaltonetworks.com/network-security/ipsec-vpn/administration/set-up-site-to-site-vpn/set-up-ipsec/set-up-an-ipsec-tunnel       Thanks. At the end of your day it's about your security intent.  You have 2 locations each with their own local "LANs" or "trust" zones.  Connecting these 2 locations, how did you want to apply security policy between traffic which flows between these 2 locations?   If you put the tunnel in the same zone as the respective site LAN zone then you're essentially calling both sites the same security layer.  If you want to start off with a more restrictive security policy then use a new/unique security zone at each location that the tunnel will be apart of. ... View more

@OtakarKlier wrote: Hello, I cant recall ever seeing an issue with either when upgrading a PAN. Both hold to pretty strict standards. SSH https://datatracker.ietf.org/doc/html/rfc4253 ARP https://datatracker.ietf.org/doc/html/rfc826   Regards, @OtakarKlier -- Palo has actually has such an issue when we were upgrading to a 10.1.X from a 10.0.X we had "weird" traffic not working issues.  In the end, it was because we had our NAT rules setup wrong.  Prior to the upgrade from 10.0.X to 10.1.X traffic worked just fine with the firewall matching traffic to the NAT policy, but in 10.1.9 (mid code) they changed how the device functioned regarding ARP (Ours was a single VR, not dual):   ... View more

@edroche3rd wrote: Howdy All! We are in need of finding a way to give a help desk individual limited access to the CLI to run a Python script to clear addresses from the DoS Blocked-Table. The 2 commands it is running is the   debug dataplane show dos block-table debug dataplane reset dos zone <zone> block-table source <ip address>   What I have found so far at a high level is either full, read, or none. Any thoughts or ideas please feel free to respond.   Thank you in advance! Ed This isn't too difficult of a task, but you'd need to create and use a TACAS+ authentication method.  Using TACACS+ you can specify what commands can be executed.  However you'd first need a TACACS+ device capable auth server, like ISE or Clearpass.  If you have either of these things, then the request is simple.  Without it I don't think Palo has an built in RBAC capability to do what you're asking. ... View more

@sushant1601 wrote: Hello,   I am part of an MSSP, and we ingest data from multiple clients. Some clients forward logs from Panorama, while others use Strata Logging Service. I would like to understand how we can differentiate logs based on their source—whether they were forwarded from Panorama or Strata. Is there a specific identifier or static keyword in the logs that indicates they originated from Panorama?     Last year also I tried to look into it but no response. https://live.paloaltonetworks.com/t5/prisma-access-discussions/understanding-prisma-access-syslog-header-amp-messages/td-p/584750   Any help would be appreciated. Thank you.   Strata Logging Service Panorama  Add this column to your log search while in Panorama:   "Strata Logging Service" = "Cortex Data Lake"     ... View more

@Hassan958 wrote: Hi Team, I’m encountering an issue with Poly devices on VLAN 20, which is routed through the firewall with its L3 interface configured. The devices successfully pair at first time with Teams but  after a reboot they fail to maintain pairing afterward, despite having a rule that allows all traffic from the VLAN 20 .   Interestingly, when these devices are moved to VLAN 10 (behind the core), they work without any issues. Note: They are not losing any Hardware connectivity and working fine on same port with Vlan 10 which is behind the core switch    Has anyone faced a similar issue or have any recommendations? Your input would be greatly appreciated. What do the traffic logs show for traffic on this VLAN? ... View more

It's going to be in your "Global Protect" log type.  You'll need to do some search strings to identify the successful login as well as using the "host ID" field.  You're also going to be limited on how much storage you've allocated to this log type.   --edit-- If you're just simply referring to an administrator that's logged into your firewall those logs would be in the system logs. ... View more

@R.Nill wrote: Got a weird one here, I'm using templates from Panorama but I have one firewall, in an HA pair, that has Telnet enabled on the Administrative Management Services section and it should be set to OFF per my template.  The interface is showing "Template Values Overridden" and when I go into the configuration and try to re-sync the template (hence disabling Telnet) I can't hit OK.  It just doesn't respond, don't understand why it's blocked or greyed out or whatever it's doing.   Configuration isn't locked and I'm a superuser.  Not really sure why I can't change it.   Any thoughts? I'm not sure, but I think you mentioned how to fix your issue with your statement.  You mentioned that the GUI says "Template Values Overridden."  This is usually indicated with a "double sprocket."  You should be able to click on that "double sprocket" and revert the config back to what's in your template.     A word of caution though, make sure you're aware of all of the overrides and that reverting them won't break something you overrode to get something working.   Normal:   Overridden:   ... View more