About Gregoux

If the on 1 appliance you stop the management plane the other appliance don't see the stoped appliance and stay actif or migrate to the activ state  ... View more

HA1 backup port associate Data Plane, Is it right? false wihile you you have a dedicated interface HA1 and as a best practice you have to use the management port as backup https://live.paloaltonetworks.com/docs/DOC-5086 Page 13 High Availability Link Failure Palo Alto Networks firewalls use HA Links to synchronize information and to send session and session state information between HA pair members. Depending on the firewall model, dedicated HA interfaces may or may not be available. If dedicated HA interfaces are available, best practice is to use these ports for the primary HA links and to configure HA Backup links to help prevent configuration mismatches, synchronization loss, and split brain conditions. HA1 Link Failure If the HA1 Link fails and there is no HA1 Backup configured, configuration synchronization will fail and a split brain condition will be created. Split brain conditions occur when HA members can no longer communicate with each other to exchange HA monitoring information. Each HA member will assume the other member is in a non-functional state and take over as the Active (A/P) or Active-Primary (A/A). Split brain conditions can be prevented by configuring an HA1 Backup link and/or enabling Heartbeat Backup. Two types of messages are sent between peers when HA is enabled.  The Control Link (HA1) communicates over a TCP connection.  The first is the 'Hello' message.  The second is the 'Heartbeat' message. more information about  Heart beat here https://live.paloaltonetworks.com/docs/DOC-2195 Hello Message The 'Hello' message is sent from each peer to the other once every configured 'Hello Interval'.  It determines if the HA Agent is running.  No response is sent by the recipient.  This message is also sent if there is a HA state change or other informational changes are needed.  This message communicates: HA state of the device Device Priority HA2 (Data Link) cookie If the 'ha_lib' connection is seen locally ('sysd' peer connection) It will also send this information when it has changed: If 'Config Sync' is enabled Config MD5SUM (to know if we are in config sync) When a commit fail has occurred Time sync if you push the time from the local to the peer Hearbeat Message The 'Heartbeat' message is an ICMP Ping that is sent to its peer every configured 'Heartbeat Interval'.  It verifies network connectivity with the HA peer. And for the last  question if the management plane (control plane) failed or restart, normaly in A/P the apliance which failed couldn't be elected active for me. that ovoid the split brain. I hope that help you ! ... View more

"If RJ45 or SFP can be given mgt function or HA1 backup port Doesn't that use dp resource?" The HA1 is used to sync the configuration the primary HA1 could be a dedicated port on platform 3000 and above the dedicated port HA1 is link to the control plane (management plane) you could use a backup HA1 that coulb be the management port link to the control plane too. HA1 could be use with dataplane port for the PA 200, 500, 2000 plateform ... View more

Hi which browser did you use? try with an other browser ... View more

be careful about the rule you have to create the rule from internet to DMZ base on the ZZZ.XXX.YYY.VVV/24 ip and not on the NAT ip. if you have a rule like deny all at the bottom of the rule list, you will see if a deny action is present in the traffic log. regard's ... View more

hi Yes it's explain when the session is offloaded but it didn't explain how the session is offloaded, i would like some detail on it. thank's ... View more

did you see that https://live.paloaltonetworks.com/docs/DOC-5724 pcap replay ... View more

why don't you try a custom application base on the host header value as signature? ... View more

you could have look there https://live.paloaltonetworks.com/message/17170#17170 also you could try with splunk to create this kind of custom report ... View more

that normal this is group includ list. you can see here only group not user if you want to enumerate user you could do that via security rule regard's ... View more

thank's for this ... View more

Sur, you could create a new application base on host header which identify your application and based on it you could create a application override rule. the application override avoid L7 analysing, in this way you disable  AV, antispyware. regard's greg ... View more