About TomYoung

Hi @D.Maas ,   Please see this thread https://live.paloaltonetworks.com/t5/general-topics/configure-saml-for-globlaprotect-and-use-groups-to-filter/m-p/1226539#M123990 and let me know if it fixes your issue.   Thanks,   Tom ... View more

Hi @Kfialkowski ,   It looks like your virtual-wire interfaces have been deleted.  I would recommend starting a new thread for the new issue.  If there was one answer that did the trick, please mark it as the solution so that others with the same problem can easily find it.   Thanks!   Tom ... View more

Hi @PaloNetworkMonkey ,   The quickest way to move the interface is to export the configuration, search and replace, and import the configuration/load/commit.  The interface can be associated with multiple services and removing/re-configuring those services in the GUI can take a while.   Thanks,   Tom ... View more

Hi @Sushilkumar ,   That error means that the NGFW has (1) Automated Commit Recovery enabled and (2) after the commit the NGFW lost its TCP connection to Panorama.   https://docs.paloaltonetworks.com/panorama/10-2/panorama-admin/administer-panorama/enable-automated-commit-recovery https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000g2QnCAI&lang=en_US   It appears that something in your configuration push is breaking the NGFW connection to Panorama.  If you have local access to the NGFW, you could disable ACR and see if the commit succeeds and if the connection to Panorama stays down.   With that said, it is recommended to manage both HA NGFWs from Panorama.  Any Panorama-pushed configuration will NOT be synced with the other NGFW.  It is also recommended that you put the HA pair in the same device group and template stack. This recommendation would require you to use template variables for HA unless you choose to configure it locally.   Thanks,   Tom ... View more

Hi @aldo-escobar ,   Have you attached an interface management profile to the interfaces that allow ping?   https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-networking-admin/configure-interfaces/use-interface-management-profiles-to-restrict-access   Thanks,   Tom ... View more

Hi @Kenya5115 ,   You can have the NGFW inspect traffic between L2 hosts without having to route them via proxy ARP.  You can connect them to L2 ports and add them to L2 zones.  Then the security policy can be used to control traffic between the 2 hosts.  You would create a VLAN interface to route traffic to different subnets.  You could even migrate your current L3 interface to L2, but you would need to add a 2nd L2 connection for one of your hosts (either directly or though the switch on a new VLAN).   https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRq https://live.paloaltonetworks.com/t5/general-topics/security-policy-between-layer-2-zones/td-p/302930   Thanks,   Tom ... View more

Hi @SShnap ,   PBF takes priority over routing.  https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/policy/policy-based-forwarding   Thanks,   Tom     ... View more

Hi @ChandrashekharD ,   If you have a static route to the IPsec tunnel interface, the VPN will NOT fail over without tunnel monitoring.  With regard to tunnel monitoring, the inside address of the Meraki should work fine.  You want to set the Action in the tunnel monitoring profile to Fail Over.   https://docs.paloaltonetworks.com/network-security/ipsec-vpn/administration/set-up-tunnel-monitoring/define-a-tunnel-monitoring-profile#id65829b80-de86-4094-bd4f-96a41cff629f   Thanks,   Tom ... View more

Hi @lovekeeyz ,   How long did you wait before logging in?  The PA-800 Series takes a while to boot up.  The login prompt will be available before it actually works.  I would try the same credentials again.   Thanks,   Tom ... View more

Hi @SShnap ,   No, there is no weight consideration with IP Hash.  https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-networking-admin/ecmp/ecmp-load-balancing-algorithms   IP Hash balances over all links the same.  If you want the 3rd ISP for backup, you can give it a higher metric.   I'm sure you already know this, but it is safer to disable PBF for now rather than remove.  Rollback becomes much faster.   Thanks,   Tom ... View more

Hi @SShnap ,   I had similar issues with 1 customer.  Changing the ECMP Load Balance Method from IP Modulo (default) to IP Hash caused all sessions with the same source/destination to always go out the same interface.  This eliminated the need for PBF, and the applications worked properly.  You could also check the box so that all traffic from a source IP address always goes out the same interface.   It appeared that the problem was that the web application wanted all traffic from the same source to have the same IP.  This change fixed the issue.   Thanks,   Tom ... View more

Hi @Bitmasker and @Metgatz ,   Panorama is required for PAN-OS SD-WAN.  https://docs.paloaltonetworks.com/sd-wan/activation-and-onboarding/system-requirements-for-sd-wan   You could also use SCM.  https://docs.paloaltonetworks.com/strata-cloud-manager/getting-started/manage-configuration-ngfw-and-prisma-access/network-policies/sd-wan-policies   Thanks,   Tom ... View more

Hi @Kfialkowski ,   If this is the default virtual-wire configuration, the following commands will delete it.   delete zone trust network virtual-wire ethernet1/2 delete zone untrust network virtual-wire ethernet1/1 delete zone trust network virtual-wire delete zone untrust network virtual-wire delete rulebase security rules rule1 delete zone trust delete zone untrust delete network interface ethernet ethernet1/1 virtual-wire delete network interface ethernet ethernet1/2 virtual-wire delete network virtual-wire default-vwire interface2 delete network virtual-wire default-vwire   If you are reusing the "trust" and "untrust" zones, do not delete them.  If your configuration is not default, then run the following commands to view them.   > set cli config-output-format set > configure # show | match virtual-wire   If there are any commands left, replace the "set" with "delete" and paste into the CLI.   Thanks,   Tom ... View more

Hi @T.Dismukes ,   PAN-OS does NOT have a Policy Analyzer tool like SCM.   Thanks,   Tom ... View more