About aleksandar.astardzhiev

Hi @Srikant ,   The only command you must remember working with Palo Alto FW is: find command keyword <keyword>     user@Panorama> configure Entering configuration mode [edit] user@Panorama# find command keyword master show device-group <name> master-device set deviceconfig high-availability election-option timers advanced additional-master-hold-up-time <0-60000> set device-group <name> master-device set device-group <name> master-device device <value> set device-group <name> master-device vsys <value> set device-group <name> master-device sync-group <yes|no> set template <name> config shared admin-role <name> role device webui device master-key <enable|read-only|disable> set template <name> config deviceconfig high-availability group election-option timers advanced additional-master-hold-up-time <0-60000> set template-stack <name> config shared admin-role <name> role device webui device master-key <enable|read-only|disable> set template-stack <name> config devices <name> deviceconfig high-availability group election-option timers advanced additional-master-hold-up-time <0-60000> set shared admin-role <name> role panorama webui device master-key <enable|read-only|disable> set shared admin-role <name> role panorama webui panorama master-key <enable|read-only|disable> set shared admin-role <name> role panorama contextswitch device master-key <enable|read-only|disable> set shared admin-role <name> role device-group webui device master-key <enable|read-only|disable> set shared admin-role <name> role device-group contextswitch device master-key <enable|read-only|disable> ... View more

Hi @Joni_Larned ,   This is the whole purpose of "SSL/TLS Service Profile". -  You select a certificate in the service profile and use this profile everywher you need. - When you need to renew/change the certificate you change it only in the service profile, which apply to all locations where this profile is being used.   In addition - you cannot refrence certificate anywhere except ssl/tls service profile. So you don't have to worrie that you need to change the certificate anywhere else.   So what you need to do is: - Find the ssl/tls service profile which is using the certificate that needs to be replaced - Edit it and select from the dropdown your new certificate - Commit and push config - You should be able to old ceritifcate now - (optional) now you can renew your new cert (removing "new_") name. This should automaticaly reflect in the service profile, but you can go and doublecheck if profile is using the update name. Commit and push to have it on the FW. ... View more

Hi @Gareth.Doyle ,   Apart from some scripting and API calls your only option is feature request. ... View more

Hi @DongQu , There are some gotchas when working with tunnel monitor, which is very crucial to remember: - Tunnel monitor are ping probes that are source from the ip assigned on the tunnel interface. - Those probes does not pass through any policy (that incluse nat and security) neither the routing tabel. Which means when you run the pings manualy they will match your NAT rule and the source will be NAT-ed behing the ip in your local proxy-id. In addition ping will check the routing tabel before being routed through the tunnel. - Source and destination of those ping probes must match your local and remote proxy. Because the tunnel monitor probes does not pass through the NAT policy the source is not matching your proxy-id and therefor it will be dropped by the IPsec tunnel. - The whole purpose of tunnel monitor is to "disable" the logical/virtual tunnel interface if the ping is failing. That is why you will see status as red, while phase1 and phase2 established. Because the tunnel interface is listed as down, the associated static routes will also be "disabled" and will be removed from forwading table (FIB), which will cause your manual pings to fail (no more route to destination)   From what I understand you will hide your local network behind one ip address and list only this address in the proxy-id. In that case I believe it is more conviniant to assign the IP that you will use for source NAT to the tunnel interface. After that just change the NAT rule to use interface ip for the dynamic ip and port nat.   This way the tunnel monitor probes will be sourced from IP that is part of the proxy-id without the need to add additional addresses to the proxy-id ... View more

Hi @JulianH, Fully aggree with @Remo. I will only add the possibility to reach the maximum capacity if the aggregated interface. You may want to consider QoS with separate profile for each sub-interface. Unfortunately here you have limit for of 32 different profiles for each sub-interface. Which means if you plan to go with applying QoS (which probably is good idea to limit the posibility one client to consume most of the interface capacity) you will be limited to 32 sub-interfaces.   ... View more