About MP18

@SIIX_Support  Do you have DNS configured on the PA? Make sure Firewall can ping and resolve the FQDN like   ping host www.google.com       Regards  ... View more

@riwang  Did you ever see the traffic logs? OR Traffic logs stopped showing up in GUI? Run this command from CLI   show log traffic direction equal backward   If you see logs on the CLI then it is GUI issue. Also Run this command to see if Traffic Log counter is incrementing or not?   debug log-receiver statistics Logging statistics ------------------------------ ----------- Log incoming rate: 12/sec Log written rate: 13/sec Corrupted packets: 0 Corrupted URL packets: 0 Corrupted HTTP HDR packets: 0 Corrupted HTTP HDR Insert packets: 0 Corrupted EMAIL HDR packets: 0 Logs discarded (queue full): 0 Traffic logs written: 162985 GTP logs written: 0   Regards   ... View more

@ashwanig9211  If you have replaced the firewall then it might be issue with upstream? You need to ask your ISP to check their side physical port for errors and logs on the ISP device.   Regards ... View more

@Purushotham  Thanks for getting back to us. Curious to know what was the fix.   Regards   ... View more

@avi_goldstain    Also you can check the masterd daemon that is responsible for HA communications between 2 devices.   less mp-log masterd.log   Regards ... View more

@Purushotham    What was the fix? ... View more

@Claw4609 Recently I have seen BUG issues with PA on firewalls and Panorama. And to get the Level 3 you need escalation done by your SE.   Regards Mahesh ... View more

@Claw4609    Are the Interfaces in Vwire mode or Layer 3 mode. We are running Few PA 220 on Version 10.2.5 with no issues so far in Layer 3 mode. Other than some BUG cannot say much about this  issue.   Try to Escalate with PA to go level 3 and see what they ??   Regards Mahesh ... View more

@SalvatoreDangelo    Under Device, High availability, General look for    Device Priority 90 Preemptive   Heartbeat Backup   HA Timer Settings Aggressive     Here heartbeat backup is HA1 backup via MGMT Interface.   Regards MAhesh ... View more

@KevinMedeiros  All these indicates that port on the PA might be bad. Its HSCI port so their is no other way you can use any other port rather than do the RMA for PA.   Regards Mahesh ... View more

@Momoj    Which PAN OS version are you using? Did this happened first time?   Do you enabled MGMT interface as HA1 backup also? Let us know what TAC says?   Regards Mahesh   ... View more

@Purushotham    What is the DHCP lease time configured? Are there more number of PC as compared to the assigned range? If users are more than DHCP assigned IP range and all of them using Network at same time then you need to increase the IP range.   Regards Mahesh ... View more

We also have HSCI 40Gig connection between two PA across the DC. In our case we have no MRV direct Single Mode connection and distance is around 14k.   Seems in your setup you have Multimode SFP from PA to MRV. Then again Multimode connection between the two MRV. As MRV can support Multimode upto 10k so if your physical distance is less than 10k it should be fine. It can be bad port on the PA.   Do you see any logs on the PA when you run this command  'less mp-log brdagent.log?   Also SFP is PA supported one? I have seen other vendor SFP also can work on PA but id some issue comes then PA support want you to use PA approved vendor SFP.   Regards Mahesh   ... View more

@vij  One way to know if cert is going to expired is using AIOPS which needs PAN OS 10. and also paid subscription of AIOPS. In this case send the email notification to email address configured in the AIOPS. Other than this I do not know anyway to monitor the certs on the PA. ... View more

@KevinMedeiros    Also what is the physical distance between two firewalls? You need to use right SFP LR  example 10k distance with the sfp. Also use this command to see port issues?   'less mp-log brdagent.log   Regards Mahesh ... View more