About Gun-Slinger

Gun-Slinger · ‎07-25-2017

Just heard back from the sales guy...here is the answer: The only systems that include add’l VSYS licenses (above 1) are the PA-50x0, PA-52x0 and PA-70x0 series boxes. The additional license for the PA-30x0 series is in the 11-12K range.

Gun-Slinger · ‎07-25-2017

Anyone run into this one? I have a TAC case open as well. Receiving the following error on a 3060 cluster when trying to add a 2nd vsys. This is not being created on panorama, this is directly on FW01. PAN-OS-7.1.10 Error: vsys2 'vsys2' is invalid. Not licensed for vsys id 2

Gun-Slinger · ‎05-26-2017

Putting it out there for votes: Among other benefits, one of the big items we would like to see in a FR is the ability for PAN to participate in STP For a layer 2 deployment the only option we have for HA state is "shut-down" on the passive. The issue with this is the increased fail-over time. We would like to move this to auto. Below is the feature request# for adding spanning tree to PAN capabilities: Feature Request ID 1225

Gun-Slinger · ‎05-24-2017

The unknown catagory: The website has not yet been categorized, so it does not exist in the URL filtering database on the firewall or in the URL cloud database. This covers a percentage of what would fall under the <24/48 life span window of a new domain, however you still run the issue of it just being a domain that hasn't been injected in the URL DB but could have been online for sometime. Also we are really interested in the "Last registared date" not the original. This should be an easy implementation as it seems like a simpler catagory to implment based on the availability of the information over some of the more complex categories that require a more time consuming process to classify.

Gun-Slinger · ‎05-24-2017

This was just implemented according to my SE.

Gun-Slinger · ‎05-16-2017

Please vote if you see this useful. This would enable a category that would scope domains deployed with a life-time less then 24hrs. Block new Domains created under 24 hour Block new Domains created under 24 hours old FR ID: 7321

Gun-Slinger · ‎05-04-2017

Is the capabilitiy available for a log-collector to leverage an enterprise authentication method such as LDAP, Radius, TACACS etc..? The config options in panorama and cli on the MN100/500 display only the ability for local admin account options and I was not able to find any write ups or discussions on this. Thank you

Gun-Slinger · ‎04-20-2017

Thank you bradk14 This is better then nothing and accomplishes the job. It would be nice if the top search bar in the GUI could parrallel search functions found in the CLI.

Gun-Slinger · ‎04-20-2017

Thank you jsalmans for the response, this was actually a direction we were looking at going. the only issue we found was when we did this with the 7.0 and 7.1 code, the logs from our 7050's were not working correctly. I did test the option of having a M500 log-collector on 8.0.2 and panorama on 7.1.9, but panorama could not connect.

Gun-Slinger · ‎04-19-2017

Has anyone found the syntx to search in the security rule-base for any rule that has "disable server response inspection" enabled. I attempted using disable-server-response-inspection eq 'yes' and other modifications of that similar syntax with no luck. I know searching for log settings is possible through the similar syntax log-start eq 'yes' etc.... Any help would be great. Thank you

Gun-Slinger · ‎04-12-2017

Anyone tested this or know if it is documented on the compatability or not with 8.0 on the log-collectors but everything else on 7.1. I know the rule of thumb that your manager (panorama) is to be your highest code version, however with the log-collector I could see this not applying. I plan on labing this but wanted to reach out to the community to see if anyone already proofed it yet. Thanks

Gun-Slinger · ‎04-10-2017

Has Palo Alto looked into the capability for security policies to be built using an exception based logic. For example: Src: 10.0.0.0/8 (except) 10.100.0.0/24 Dst: ** App: ** etc.... This would then allow all 10. traffic except for the 10.100.0.0/24 subnet This is a function available in Checkpoint and some other platforms that has been very helpful, especially in preventing our policies from being filled with random drop rules. Thank you

Gun-Slinger · ‎04-10-2017

Does anyone know the syntax used to create filters for port or IP ranges? For example, I want to filter on IP's 10.0.0.1-10.0.0.5 9same for port ranges). Thanks in advance

Gun-Slinger · ‎04-08-2017

Feature Request Submitted. If anyone else is looking for this feature please have your SE vote for the following: FR ID: 7154

Gun-Slinger · ‎04-07-2017

Has the thought been made to allow admins to restrict an API account to certain commands? For example API accounts built for dynamic address groups but you don't want them to be able to run any other commands..?

Member Since	‎08-06-2014 08:13 AM
Date Last Visited	‎04-11-2024 04:22 PM
Posts	113
Total Likes Received	16

Online Status	Offline
Date Last Visited	‎04-11-2024 04:22 PM

About Gun-Slinger

Re: NFS sessions undecided after fail-over

Re: TS-Agent CANNOT redistribute user-ip-port mappings

Re: NFS sessions undecided after fail-over

Re: Cert Delete and Created new devicecert

Cert Delete and Created new devicecert

Re: App-ID Windows-Remote-Managment showing as Web-Browsing

Re: App-ID Windows-Remote-Managment showing as Web-Browsing

App-ID Windows-Remote-Managment showing as Web-Browsing

Re: MLAV cloud error, all machine Learning engines stopped

Warning: The admin has enabled the virtual system vsysX as User-ID Hub(Module: useridd)

Re: NFS sessions undecided after fail-over

Re: Not licensed for vsys id 2

Re: Cert Delete and Created new devicecert

Re: App-ID Windows-Remote-Managment showing as Web-Browsing

Re: App-ID Windows-Remote-Managment showing as Web-Browsing

Re: TS-Agent CANNOT redistribute user-ip-port mappings

Feature Request List

Re: Feature Request List

Re: Palo Alto Layer 2 bridging

Re: Monitoring BGP stats using SNMP

Nominated Discussion: App-ID Windows Remote Management Showing Up As Web-Browsing

Re: Not licensed for vsys id 2

Not licensed for vsys id 2

Palo Alto Participation in Spanning Tree Protocol

Re: New URL filtering category/feature for new domains (less then 24hr)

Re: New URL filtering category/feature for new domains (less then 24hr)

New URL filtering category/feature for new domains (less then 24hr)

Log-collector utilizing authentication methods (LDAP/Radius/TACACS etc..)

Re: Filtering for security policies with DSRI enabled

Re: Log-collector on 8.0 and panorama/FW's on 7.1 - Compatibility?

Filtering for security policies with DSRI enabled

Log-collector on 8.0 and panorama/FW's on 7.1 - Compatibility?

Security Policy Exception

Log filter for RANGE of IP's or Ports

Re: Restricted access to API?

Re: Restricted access to API?

Unlock your full community experience!

About Gun-Slinger