About TomYoung

Hi @Kandarp_Desai ,   All the docs say "the Panorama virtual appliance on Azure supports only 2TB logging disks."  https://docs.paloaltonetworks.com/panorama/10-2/panorama-admin/set-up-panorama/set-up-the-panorama-virtual-appliance/expand-log-storage-capacity-on-the-panorama-virtual-appliance/add-a-virtual-disk-to-panorama-on-azure   The "request system disk add" will not work if it is not the exact size shown in the "show system disk details" command.   Thanks,   Tom ... View more

Hi @Pras ,   That is a strange issue.  Yes, the best thing to do is regenerate the root CA.  This accomplishes the same thing as the renew button except you have to manually add the certificate attributes.   In either case, you will have a new CA.  Any certificates issued by the CA will need to be replaced.  Any devices trusting the old CA will need to trust the new CA because it will be a different certificate.   Thanks,   Tom ... View more

Hello @s.nguyen and @Vincent.Cai ,   Here is the form to request login assistance to the CSP.  https://www.paloaltonetworks.com/services/support/login-assistance   Thanks,   Tom ... View more

Hi @tinhnho ,   The PA-5260 supports 25 base virtual systems.  The PA-3220 supports 1.  https://www.paloaltonetworks.com/products/product-comparison?chosen=pa-5260,pa-3220   First, you would need to purchase a vsys license for the PA-3220.  Second, you would create a new virtual system.  Third, you will create separate administrator roles for each virtual system.  Then, your customers can configure their vsys just like a regular NGFW.  Vsys1 can continue to be one of those virtual systems.  I think you will need to assign interfaces to each vsys before the customers can use them.  It has been a while.  You could go with separate physical interfaces or use trunk ports and assign different sub-interfaces to each customer.   Thanks,   Tom ... View more

Hi @Mlhras0 ,   You can create 3 portals and gateways on your NGFW as long as you have 3 public IP addresses attached to 3 interfaces.  They can be loopbacks.   You can control access through the security policy:   VPN1 gateway tunnel tied to zone1.  Authentication is Azure.  The matching security policy rule: Zone1/Source device = match HIP object for domain VPN2 gateway tunnel tied to zone2.  Authentication is Azure.  The matching security policy rule: Zone2 Can optionally include Zone1 in the same rule if fallback to this rule is needed for non-domain PCs. Vendor gateway tied to zone3.  Authentication is AD.  LDAP is also setup to query group membership.  The matching security policy rules: Zone3 - source user vendor1 group. Zone3 - source user vendor2 group. Etc. Since the separation is done in the security policy you could combine gateways 1 and 2.  You could even combine all 3 into 1 portal and gateway, but that would require extra configuration.   Thanks,   Tom       ... View more

Hi @S_Williams901 ,   You can move objects (and policies) in or out of Shared with the Move button on the bottom.   Thanks,   Tom ... View more