About TomYoung

Hi @MervynChan ,   That is correct, but adding Panorama is only a couple credits!  Check out the credit estimator above.  You could buy a vNGFW and not use it.  I was told by distribution this works, and is an affordable way to purchase Panorama.   I would LOVE it if someone would respond and say they have done this.  I did not use credits to purchase Panorama.   https://docs.paloaltonetworks.com/vm-series/10-1/vm-series-deployment/license-the-vm-series-firewall/software-ngfw/provision-panorama   Thanks,   Tom ... View more

Hi @lizarraga ,   I can think of 5 ways to do it:   Find a spare PA NGFW that supports both 8.1 and 10.1 and use it.  In most cases any PA NGFW will do.  In rare cases, a few features will be missing if you use a lower end model.  You could even borrow a standby unit. Panorama if you have it.  Add the new NGFW to the same template and device group as your old NGFW.  Panorama must be greater or equal PAN-OS. Expedition if you are familiar with it.  The PANW migration tool:  https://live.paloaltonetworks.com/t5/expedition/ct-p/migration_tool saves a lot of time with migrations. Import the old PAN-OS XML file and be prepared to work through commit errors.  Some sections can be fixed on the CLI.  Others will need to be deleted and recreated in the GUI.  Some people on this community say the NGFW will try and convert it.  I have never tried it. You could also cut-and-paste on the CLI and work through each error.  Ugh! Thanks,   Tom ... View more

Hi @eastsidebuzz ,   I ran into the exact same thing with a customer once.  He was using MacOS terminal.  We switched to Putty and it displayed fine.  Bottom line:  Try a different terminal program.  I have seen terminal programs work with other devices but not with the PANW console.  The serial connection settings are probably correct, but please double check.  The hardware should be fine.   https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClkFCAS   Thanks,   Tom ... View more

Hi @Metgatz ,   Very interesting!  I think the data sheet should read connections per second.  The values are almost the same as here -> https://www.paloaltonetworks.com/products/product-comparison?chosen=pa-5260,pa-5250,pa-5220.   That is the 1st document where I have seen sessions per second.   Thanks,   Tom ... View more

Hi @GOMEZZZ ,   Go to Monitor > App Scope > Network Monitor.  Change the filter on top to Source User.  Change the Top 10 in the top left to your preference.  Change the time period on the bottom.   You should also be able to build a custom report with the same data.  I don't think the NGFW will do bytes/second, but you could do the math.   Thanks,   Tom ... View more

Hi @Metgatz ,   I don't see "sessions per second" on my Panorama.  I see the following:   Session Count = Total session count over time (five-minute average). Connections per Second = Total CPS for the device over time (five-minute average). = new connections Packet per Second = Total packets per second (averaged over five minutes) that passed through the device.   I got those definitions by clicking on the ? in the upper right and navigating to Panorama > Managed Devices > Summary : Detailed Device Health on Panorama : Sessions.   Thanks,   Tom ... View more

Hi @Pankaj_Dhobe ,   What is your cache timeout set to?  I have noticed with some customers that they authenticate only in the morning.  They would have User-ID mappings in the morning, but not during the day.  I increased the cache timeout to 10 hours so they would have the mappings all day (work day).  Here is a doc where you can determine if it is a cache timeout issue -> https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000001Uu5CAE&lang=en_US%E2%80%A9.   Thanks,   Tom ... View more

Hi @HassanThiam ,   Do you have an interface profile applied to your interface connected to the ISP that allows pings? https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClMmCAK Otherwise pings will not be allowed, and an ARP request will not be sent. Do you source your pings from the IP applied to the interface connected to the ISP? https://live.paloaltonetworks.com/t5/blogs/tips-amp-tricks-how-to-ping-from-the-cli/ba-p/468784 Otherwise the pings will be sourced from the management IP address. Again, no ARP request will be sent out the ISP interface. Do you see the pings in the traffic logs (Monitor > Logs > Traffic)? Pings from an interface will be allowed by the intrazone-default rule. Logging will need to be enabled on the rule.  https://docs.paloaltonetworks.com/best-practices/9-1/data-center-best-practices/data-center-best-practice-security-policy/log-and-monitor-data-center-traffic/log-intra-data-center-traffic-that-matches-the-intrazone-allow-rule You can also enable logging on the interzone-default rule.  Then you should see all IP traffic through the data plane, allowed or dropped. Logs confirm the NGFW is attempting to send pings. Have you verified the NGFW is not receiving ARP by using the "show arp" command on the CLI? You should see a MAC address (received) or incomplete (not received). The incomplete times out fairly quickly.  The command needs to be run as soon as the ping is done. Thanks,   Tom ... View more

Hi @AaronAxvig ,   Monitor > Logs > Authentication will show events related to the Authentication Policy -> https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/monitoring/view-and-manage-logs/log-types-and-severity-levels/authentication-logs.   Thanks,   Tom ... View more

Hi @Kunal_Tomar ,   If you know the CLI commands to view the info, then you can view the information via the XML API.  You can navigate the XML API interface by browsing to /api after your NGFW IP or DNS name.   You mentioned REST API in your post.  There is a link to the REST API on the XML API page described above.  PANW uses REST (like many vendors) only for configuration changes.  So, technically, you would use the XML API to get your info.   Typically monitoring tools use SNMP to collect the info you described.  If you can't get it via API, then you could look into SNMP.   Thanks,   Tom ... View more

Hi @Benny.Rosa ,   Here is an article that describes your issue with a couple of fixes -> https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cli0CAC.   Notice that Option 2 has the CLI commands to generate a new certificate.   Thanks,   Tom ... View more

Hi @Carlos_N ,   Yes, that should work.  Because the NAT type is static, the last octect should stay the same.  This technique is most often used with overlapping subnets between organizations.  Please see example #5 (page 18) in this tech note -> https://live.paloaltonetworks.com/twzvq79624/attachments/twzvq79624/members_discuss/15121/1/TechNote_UnderstandingNAT.pdf.  (Some IP addresses look wrong in the pic, but are correct in the examples.)   Thanks,   Tom   Edit:  Hi @Carlos_N , My apologies.  I did not realize the URL was local.  I have corrected it.  Here is another example -> https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClNxCAK.   It is interesting to note that these examples are found in older documents.  I see no mention of it here -> https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClOLCA0.  Nonetheless, I think this is an essential feature, although rarely used.  I hope it is still available.   ... View more