About aleksandar.astardzhiev

aleksandar.astardzhiev · ‎06-25-2023

Hi @Suhairul_Salleh , Unfortunately it seems PAN haven't published official IPS signature to cover this vulnerability, yet.

aleksandar.astardzhiev · ‎06-25-2023

Hi @Hendrik9 , Can you confirm if your Zone associated with GlobalProtect tunnel is configured with Zone-Protection profile? Is this zone-protection profile using SYN Cookie for TCP flood protection?

aleksandar.astardzhiev · ‎06-25-2023

Hi @GrantCampbell4 , As mentioned at the bottom of this link DN and LN regions were added recently - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClFFCA0 So it looks like your PA-3220 firewall does not use the latest dynamic package updates compared to the Panorama and PA-450. First step would be to "check now" and install the latest dynamic content packages on the firewalls and try again to push config from Panorama.

aleksandar.astardzhiev · ‎06-25-2023

@TomYoung wrote: .... PS Definitely use the Group Include List under your group mapping so that the NGFW only queries for users in those groups. That saves lots of CPU cycles. Or use Cloud Identity Engine, which automatically sends only the groups that are used by FW (in policy, GP or allow list) without the need to manually define include list 🙂

aleksandar.astardzhiev · ‎06-25-2023

Hi @Khassam , As I already mentioned - everything that is logged as log event can be forwarded as SNMP trap, you just need to find which log type and subtype to filter by. The type of information you mention is in system logs. Here you can see what subtype its covers - https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/system-log-fields https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/monitoring/view-and-manage-logs/log-types-and-severity-levels/system-logs

aleksandar.astardzhiev · ‎06-20-2023

Hi @PAnh , As mentioned in the API docs member is array of strings, which means you can list multiple values there { "entry": [ { "@name": "{{name}}", "static": { "member":[ "{{member}}", "{{member2}}", "{{member3}}" ] } } ] }

aleksandar.astardzhiev · ‎06-20-2023

Hi @KimSiah , I don't have experience with Global Accelerator, but when reading AWS docs it is basically an Anycast public address. Which if I could just simplify - traffic to the Global Accelerator IP will be "forwarded" to the ALB, but again over the Internet Gateway. I am assuming the anycast IP will use ALB public IP and for that will also need IGW to be deployed, which means same GWLBendpoint should be sufficient. I am curious if have tested it and what is the result.

aleksandar.astardzhiev · ‎06-20-2023

Hi @t.jithendra , If your are asking regarding the MFA for your Palo Alto account (support portal, app hub, live community, beacon etc) the short anwser is - you cannot. As mentioned here - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClN9CAK MFA is mandarory for all CSP accounts.

aleksandar.astardzhiev · ‎06-20-2023

Hi @Khassam , You have understand that correctly - SNMP traps in PAN firewalls are configured with log forwarding profiles, where you can specify which log type to be forwarded as trap. However the screenshot you have provided is for Log Forwarding object, which is used for "traffic related" logs that you can apply on any security rules. What you actually need is here - https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-web-interface-help/device/device-log-settings For your specific case you need to configure log forwarding for System Logs and using the Filter to specify which exactly sub-type system logs you want to send as traps. From top of my head I believe the following from your list are available as system logs and therefor can be forwarded as traps: - interface status: log event for up or down is generated - temperature: not completely sure, but I believe system log will be generated when critical temp is reaced - cpu management and data: similar to temp, when critical levels are reached it should be logged. - ha state: change in member state (passive, active or down) will be logged as well as HA interfaces (they are logged in ha sub-type ) I am not sure the following can be sent as traps: - int bandwidth - log rate - session count

aleksandar.astardzhiev · ‎06-20-2023

Hi @s0lselcia , As far as I am aware there is no easy way to do that...Especially if you are using UDP for syslog. If Syslog over UDP was used there is no way for the firewall to know if remote syslog server is up or down as there is no acknowledgment. I am not completely sure if TCP is used...In theory it should provide the necessary information for FW to know when exactly remote syslog stopped receiving logs, but I don't have real experiance if it will resume from that point or again from the moment TCP connection is re-established. The only workaround I can think of is log export to SCP or FTP server - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Clj3CAC (bottom of the page follow the steps for CLI export)

aleksandar.astardzhiev · ‎06-20-2023

Hey @HKoppuravori , I can confirm what @TomYoung explained, just to highlight that this is possible as long as the original and translated networks are exactly the same lenght - /24 natted to /24, or /28 natted to /28. Commit will fail if you try to nat different prefixes.

aleksandar.astardzhiev · ‎06-20-2023

Hi @ChinLong , Check if the following link provides you with required information - https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/monitoring/snmp-monitoring-and-traps/supported-mibs Please have in mind the following KB if you plan to monitor subinterfaces throughtput - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000boDtCAI

aleksandar.astardzhiev · ‎06-20-2023

Hi @gongya , Q: Can HA1 be on different networks? A: Yes it can. HA1 is control link - it is used for keepaliaves and hellos, also for config sync. As you can see from the docs it is actually requiring to enter local and peer IP and network. If the members are in different networks you need to specify gateway as well - https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-web-interface-help/device/device-high-availability/configure-ha-settings HA2 is the data link - it is used for session sync. By default this link is set to "Ethernet" for transport type. This can only be used if FWs are connected directly or at least in the same layer2 broadcast. However you can config the transport to use IP or UDP, which should allow you to have HA2 in different networks. Default is ethernet, because it is always recommended to have high-speed reliable connection for session sync, but you can change it. Q: Can 2 Palo Alto nodes be standalone with sessions synced ? A: Depends...PAN call this "HA Clustering" (which for me is little confusing with standard active/passive). It was introduced fairly recently - https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/high-availability/ha-clustering-overview It is supported only of some physical devices and not on public cloud platforms.

aleksandar.astardzhiev · ‎06-20-2023

Hey @Sanjay_Ramaiah , It looks you have used different account when you first posted your question. I have accepted @PavelK answer as solution on your behalf.

aleksandar.astardzhiev · ‎06-20-2023

Hi @Carracido , I believe you need to perform steps 2 and 3 from the following link - https://docs.paloaltonetworks.com/panorama/9-1/panorama-admin/set-up-panorama/set-up-the-panorama-virtual-appliance/expand-log-storage-capacity-on-the-panorama-virtual-appliance/add-a-virtual-disk-to-panorama-on-an-esxi-server The docs also mention In Panorama mode, you can add disk sizes larger than 2TB and Panorama will automatically create as many 2TB partitions as possible. For example, if disk sdc was 24TB, it will create 12 2TB partitions. These disks will be named sdc1-12. So it is expected what you see for your 12TB disk to be split in 6 partitions. You probably need to run > request system disk add sdd # Your 12TB disk After that you should be able to add more disks in Panorama -> Managed Collectors -> <panorama-hostname> -> Disks (explained as step 3 in the docs)

Member Since	‎08-01-2017 11:18 PM
Date Last Visited	‎12-22-2025 12:06 AM
Posts	1,077
Total Likes Received	448

Online Status	Offline
Date Last Visited	‎12-22-2025 12:06 AM

Unlock your full community experience!

About aleksandar.astardzhiev