About TomYoung

Hi @Metgatz ,   I have done this many times with many NGFWs.   With regard to "That means that the two certificates should be uploaded to the active firewall?"  No.  Upload each certificate to each firewall.  It's true that you can upload it to the active and push it before it is configured as a management certificate, but why?   With regard to "This is achieved in this way right?"  No.  The most straightforward way is to configure the management certificate, SSL/TLS profile, and management interface settings on each firewall locally.   Thanks,   Tom   ... View more

Hi @Schneur_Feldman ,   That is a great question.  PANW has many documents with regards to best practices for dynamic updates, one of which is mentioned by @PavelK.  I have seen the update intervals change over the years, getting smaller as PANW increases their frequency of providing updates.   For my NGFWs, I always load the Day 1 Configuration 1st.  It includes the current best practice update schedule for each update.  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PM2lCAG  It also includes many other best practices.  Afterwards, in order to keep up with best practice changes, I run a BPA on Panorama or a selected NGFW.  https://docs.paloaltonetworks.com/best-practices/9-1/best-practices-getting-started/get-started-with-best-practices/access-and-run-the-bpa   This is the best way I have found to stay updated to best practice recommendations.   Thanks,   Tom   Edit:  If you want to learn more about best practices in general, go here -> https://docs.paloaltonetworks.com/best-practices.   ... View more

Hi @Metgatz ,   The 1st URL that you provided states that "Certificates for Device Management", "SSL/TLS Service Profile for Device Management", and "Management Interface Settings" for "SSL/TLS Service Profile" are not synchronized between HA pairs.  So, everything is done locally.   Configure the management certificate, SSL/TLS profile, and management interface settings on each firewall.   Thanks,   Tom ... View more

Hi @SomeGuy1000 ,   Do you have multiple certificates that could potentially be used?  If so, check this out -> https://docs.paloaltonetworks.com/globalprotect/9-1/globalprotect-admin/authentication/about-globalprotect-user-authentication/how-does-the-app-know-which-certificate-to-supply.   Or, if there is only one unique certificate, it could be how the PC handles certificate requests -> https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HBVpCAO&lang=en_US%E2%80%A9&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail.   Thanks,   Tom ... View more

Hi @serge.kovalev ,   Yes, it is possible.  Are you using full-tunnel or split-tunnel?  If split-tunnel, ensure 172.16.1.0/24 is part of the split-tunnel access route.   Thanks,   Tom ... View more

Hi @JoshuaSanders ,   I have been able to resolve all my auto-commit errors through looking up the auto-commit in the Task Manager and finding the reason for the failure.  I am either able to fix the syntax error in the CLI or, worst case, modify the HTML and reload.   For your case with multiple upgrades, maybe wait until a newer version of 10.0.X fixes the error.   Thanks,   Tom ... View more

Hi @laurence64 ,   I upgraded mine a few weeks ago, and it was even slower than 10.1.  I then downgraded back to 10.1.  PAN-OS 10.0 and 10.1 have known issues with PA-220 slowness.  I didn't see any for 10.2.  So, I was hopeful.  Maybe I will try a later release if I see more positive feedback on this thread.   Thanks,   Tom ... View more

Hi @mario.chancay ,   Thanks for asking!  I don't know if you still look at this thread.   Must Have: * Echo what @PANcake says below.  Add a column on Monitor > Logs > Traffic for the matching NAT rule. * Schedule software upgrade from Panorama.   Nice to Have: * The ability to select multiple items at once from a drop down menu.  For example, if I want multiple source addresses in a security policy rule, I currently have to click Add, select one, click Add, select one. etc. * Change Link State to down for sub-interfaces. * SSO for clientless VPN for the same SAML iDP.  (I think the NGFW would have to intercept and store the iDP cookies.) * Template variables for GlobalProtect interfaces (portal physical, gateway physical, and gateway tunnel).   If anyone is drive-by browsing and would like to see this feature, like this post!   Tom   ... View more

Hi @RameshShrestha ,   This process has changed.  Please review this doc -> https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClN9CAK.  Jump to the link in the 2nd bullet, Configure 2FA Methods.  You will see this URL https://sso.paloaltonetworks.com/enduser/settings where CSP users can setup their MFA methods.  Please note that MFA is now turned on all accounts and cannot be turned off.  Email should be enabled by default for all users.   Thanks,   Tom ... View more

Hi @miguelgzz ,   With regard to moving bulk configuration, the 2 main ways are through CLI and load config partial.  CLI is the easier of the two by far.  Here is a doc that shows how to "Import Palo Alto Networks Firewall Configurations into Panorama" https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Clf2CAC&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail, but it can be easily modified to move a config from 1 vsys to another.   Load config partial can actually be faster, but takes longer to learn.  https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-cli-quick-start/use-the-cli/load-configurations/load-a-partial-configuration  The Xpath (XML path) is the trickiest, but can easily be looked up in the API Browser.  https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-panorama-api/get-started-with-the-pan-os-xml-api/explore-the-api/use-the-api-browser  There is also an API Debug -> https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-panorama-api/get-started-with-the-pan-os-xml-api/explore-the-api/use-the-web-interface-to-find-xml-api-syntax.   Thanks,   Tom   Edit:  Thank you @blwavg for the 3rd option of Expedition!  It DOES have excellent cleanup tools.  Did you import export configs or push the changes via API from Expedition? ... View more

Hi @NavidAlam ,   I believe after you change the password you have to commit the configuration for it to take.  I could be wrong.   Thanks,   Tom ... View more

Hi @IMTechSupport ,   In addition to the Domain Credential Filter that @BPry mentioned, scale is also a consideration.  Here is a great article -> https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClpICAS.   Thanks,   Tom ... View more