About TomYoung

Hi @Sanjay_Ramaiah ,   If the config is not too large and you may not do this again, it may be best to manually configure the PA.  Generally, you assign a zone to each interface on the Check Point.   If the migration is huge, then it will pay off to use Expedition.  https://live.paloaltonetworks.com/t5/expedition/ct-p/migration_tool  You can search on that page and find lots of discussions.  Here are a couple good ones you may like:   https://live.paloaltonetworks.com/t5/expedition-discussions/checkpoint-r80-10-migration-document/td-p/256083 https://live.paloaltonetworks.com/t5/expedition-articles/migrating-checkpoint-r80-updated-on-december-2020/ta-p/216298 https://live.paloaltonetworks.com/t5/expedition-discussions/expedition-error-upload-tgz-checkpoint-r81/td-p/328700   One thing that I really like about Expedition is the ability to clean up clutter that has accumulated over the years.  It does a great job of identifying unused configuration.   Thanks,   Tom ... View more

Hi @BusanaB ,   One method you could use is to verify the domain retrieved under host info:     If the domain matches the HIP object, then it is a device in the domain.   Thanks,   Tom ... View more

Hi @eax0x01 ,   That is very strange.   I'm sure you have already done this, but have you hit enter a few times?   If that doesn't do it, i would double check your VM install process.   Thanks,   Tom ... View more

Right, and right. ... View more

Hi @Matlu_NN ,   You can create a test user as you described and test.  You would need to create an authentication profile with a Type: Local Database, and test against that authentication profile.   Thanks,   Tom ... View more

Hi @Matlu_NN ,   That is correct.  When you create an administrator you can configure an authentication profile for that administrator.  Your admins could authenticate with their AD credentials (LDAP) if you want.  In order to use the local user database, you would create an authentication profile with a Type:  Local Database.  Then you could use the test command.   Thanks,   Tom ... View more

Hi @Matlu_NN ,   Great question!  Since you have no local authentication profile, I assume the "local users" are under Device > Administrators and not Device > Local User Database > Users.   You cannot use the "test" command to test for local administrators.  You would test by logging into the GUI or CLI with each username.   Thanks,   Tom ... View more

Hi @eax0x01 ,   I think it is normal when you 1st install the NGFW.  Normal reboots should take less time.   Thanks,   Tom ... View more

Hello @eax0x01 ,   You need to wait for the "PA-VM Login:" prompt before the login will work -> https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CloQCAS.  The NGFW is still booting.   Thanks,   Tom ... View more

Hi @grenzi ,   I am curious.  I have a customer with a PA-5220 w/ PAN-OS 9.1, and the aux interfaces do not show up under Network > Interfaces.  They show up under Device > Setup > Interface.  Do you see them under both or just one?   Thanks,   Tom ... View more

Hi @Matlu_NN ,   The CLI command is not configuring anything on the NGFW, but rather setting the context for your CLI test command.  As the doc says in step 1, "Specify which virtual system contains the authentication profile you want to test. This is only necessary if you are testing an authentication profile that is specific to a single virtual system (that is, you do not need to do this if the authentication profile is shared)."   This command only applies to the current CLI session.   Thanks,   Tom ... View more

Hi @Matlu_NN ,   I don't see you setting the target vsys.  Have you followed these steps?  https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-cli-quick-start/use-the-cli/test-the-configuration/test-the-authentication-configuration   Thanks,   Tom ... View more

Hi @SandipKumbhar ,   PAN-OS does not support Google MFA natively -> https://docs.paloaltonetworks.com/compatibility-matrix/mfa-vendor-support/mfa-vendor-support-table#id17CBB0W095Z.   One solution that you can use is a RADIUS server that supports both LDAP and Google TOTP, e.g. https://sysopstechnix.com/enable-2fa-on-freeradius-with-openldap-users/.  I just Googled that one.  I have not used it.   On the NGFW, all you do is configure the RADIUS server for GlobalProtect.  Check out the diagram in the 2nd URL.  If you do not want users to get prompted twice for MFA (portal and gateway), you can (1) enable authentication cookies or (2) use RADIUS for the portal and LDAP for your gateway.   Thanks,   Tom     ... View more