About wimjuste

Meanwhile I also received feedback of our Palo Alto Networks local systems engineer. Allow me to share this information, because it revealed to root cause / answer to our problem. NAT device binding options include the following: Device 0 and Device 1—Translation is performed according to device-specific bindings only if the session owner and the device ID in the NAT rule match. evice-specific NAT rules are commonly used when the two firewalls use unique public IP addresses for translation Both—This option allows either device to match new sessions to the NAT rule and is commonly used for destination NAT Primary—This option allows only the active-primary device to match new sessions to the NAT rule. This setting is used mainly for inbound static NAT, where only one firewall should respond to ARP requests. Unlike device 0/1 bindings, a primary device binding can move between devices when the primary role is transferred ... View more

The assigned system support engineer provide exactly the same information as described by you. Concerning the 'awkward' phenomenon about starting fined grained information after having build that custom report, that must have been a coincidence/mix up. Now, all information is available while drilling down into menus of the Application Command Center. Thanks again for your valuable feedback. ... View more

Hi Mkiand, Thx for your suggestions ! Yes indeed: - NTP has been configured, even before the (data) interfaces were connected. So, onboard time sync was and is now also still in sync. - For data we want to see, there's an LOG AT START enabled. Should both (start/end) be enabled preferably to have correct and relevant data in ACC ? I already informed our Palo Alto engineer about this issue. He asked to open a support case in order to have a closer look. Just 1 remark: I don't know whether there's a link between both, but after creating a CUSTOM REPORT which forced to get data from the threat database for the past +/- 24hours, drilling down into the "Threat monitor" reveals fine grained information about sources/destations/etc. So, I tried to build a similar custom build report that forced to fetch data from "traffic" database, though the result was not successful: "no matching record" after drill down in the "Traffic monitor" I'll keep this thread up to date once a solution is provided from the support case.  ... View more

Thx Bulent, From a secure configuration baseline policy point of view, deleting (or rather replacing it) the default administrative accounts, should be the first thing to do ... View more

Damn too bad. A technical shortcoming. We already asked our PAN SE to apply for a feature request in order to have all operators available through all attribute in the policy rule editor. Nevertheless, this one might do the job: 1) filter all rules that includes a security profile group, using profile-setting/group eq 'my-group-reference' 2) Once filterd, select all rules listed. 3) Remove the selection criteria from the policy editor. Now all rules including a security profile group are selected, which should be the majority. Rules that do not have security group enabled (or different) are not selected. A visual cross check will indicate the suspected rules. I must admit that it takes some creative thinking to come to such a nasty solution .. Kind regards, Wim ... View more

Hi emr, Thanks for reply, your answer is helpful. For instance, we use a predefined set of security groups (but I didn't mentioned this one in my question) Though, your feedback is applicable for security groups as well ! 🙂 (profile-setting/group eq 'my-group-reference') I thought to be smart and use the "NEQ" operator in order to find out all rules WITHOUT a 'my-group-reference', but then, NONE rules are displayed. (suppose is would be the same as (profile-setting/profiles/virus neq 'default') Do you know perhaps how to inverse the (profile-setting/group eq 'my-group-reference') ? Thanks again ... ... View more

Don't they mean the HEARTBEAT interval parameter? Because the minimum value for HELLO on PA-5020 is 8000ms, I can't imaging having to wait for 3x 8000ms before a failover takes place? If not, what is the purpose of the HEARTBEAT interval parameter? Also, is the 3 times retry value configurable? ... View more