About TomYoung

Hi @ssovee ,   That's a good start!  I have a couple of observations:   Invalid Credential most likely means the key is wrong.  You may want to double check the key. You have too much in your 2nd URL.  You should get rid of the "<request cmd="op"><operations>" and "</operations></request>".  Those were not in your 1st URL and not needed. Have you tried the XML API Browser?  You can drill down in the menu and get the exact URL syntax you need.  You can also add the "all" keyword (which is correct) and click Submit to test.  You can fully test your XML syntax before using it in curl. The command curl -k -X GET "https://a.b.c.d/api/?type=op&cmd=<show><virtual-wire>all</virtual-wire></show>&key=CorrectKey" works for me. https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-panorama-api/get-started-with-the-pan-os-xml-api/explore-the-api/use-the-api-browser   Thanks,   Tom ... View more

Hi @nw-rogox ,   Active/active does give you the advantage of doubling your NGFW throughput.  However, in a failure scenario the throughput is cut in half which may not be desirable.  The additional complexity of active/active is generally not recommended.  Designs that are too complex tend to not only be a pain to configure as you are feeling now, but they also tend to be a pain to maintain, i.e., new problems may come up in the future.   For example, you cannot use a floating IP address in NAT unless you have a common BGP public IP across both ISPs.   I do not know of any documents to help you.  I did do a quick Google search and saw a couple videos you may look at.  They both used the switch to connect the dual ISPs to both NGFWs.   Sorry!  That is all I have.   Thanks,   Tom ... View more

Hi @Ismailsh ,   That is a great question!  EDIT:  Sorry!  I thought you were asking about custom EDLs.  The built-in EDLs are updated through content updates.  https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/policy/use-an-external-dynamic-list-in-policy/built-in-edls  I don't think the NGFW logs those changes.   To check the status of custom EDLs, you can check Monitor > Logs > Systems for EDL messages.  Use the filter ( description contains 'EDL' ).  The logs will let you know if the refresh succeeded or failed, if there were updates or not, etc.   You can also examine the contents of the EDL itself under Objects > External Dynamic Lists > [edit list] > List Entries and Exceptions.   EDIT2:  It looks like the built-in EDLs are updated with the AV updates.   > request system external-list stats type predefined-ip name panw-known-ip-list Predefined IP list available in AV content   I checked the List Entries of "Palo Alto Networks - Known malicious IP addresses" before and after an AV update, and the number changed.  I am currently getting an AV update everyday, although I do not know if the built-in EDLs change with every update.   Thanks,   Tom ... View more