About TomYoung

Hi @Joshan_Lakhani ,   It may be a bug in PAN-OS 9.1.11.  I am running 10.1.3, and the comand works fine for me.   tyoung@fdsnsdfw01> show arp management <response status="success"><result> <total>2</total> <entries> <entry> <interface>eth0</interface> <ip>removed</ip> <mac>removed</mac> <status>C</status> </entry> <entry> <interface>eth0</interface> <ip>removed</ip> <mac>removed</mac> <status>C</status> </entry> </entries> </result></response>   Thanks,   Tom ... View more

Hi @davistg ,   Did you create the zone first with the "set vsys vsys1 zone test" command?  Also, you will need to create interface ethernet1/17.66  as a layer3 interface if it doesn't already exist.  Then, your command should work.   Thanks,   Tom ... View more

Hi @Travis_Molleck ,   You can use the "test security-policy-match" command on the CLI.  It won't do bulk, but you can make text edits to it easy and paste the new command.   Thanks,   Tom ... View more

Hi @a.jones ,   It is difficult to troubleshoot your issue without more details.  With that said, have you considered leaving the /30?  Since you are moving to active/passive, then you do not need separate IP addresses for the passive firewall.  The same IP addresses are configured on both.  The IP addresses on the passive firewall do not respond to traffic until it becomes active.   Thanks,   Tom ... View more

I have macOS Catalina, and I ran into the same issue.  So, it is not the issue in the KB article for Windows.  Previous upgrades worked fine.  For 5.2.8, I would get a popup, then nothing.  I chose to download the software from the portal and manually upgrade.  That process worked fine. ... View more

Hi @tonyrobson ,   Great question.  I wondered the same thing myself.  On a firewall with the default single vsys, the certificates and SSL/TLS service profiles are stored in shared, although you cannot see or set the location in the GUI.  You can see it in the CLI with the "show shared certificate" and "show shared ssl-tls-service-profile" commands.  So, on the single-vsys NGFW, you can only choose SSL/TLS service profiles in shared from Device > Setup > Management.  I first noticed this behavior on a multi-vsys firewall.  It seems to be built in and cannot be set to choose from vsys1, possibly because PANW does not want device management config tied to a vsys.   Thanks,   Tom ... View more

@TonyTam is correct.  When you initially import a firewall configuration into Panorama, you need to "Export or push device config bundle" to remove the local configuration and replace with Panorama configuration.  If you try Commit > Push to Devices you will get the "already in use" or "duplicated name" errors.  You only have to do it once, and then you can manage from Panorama normally. ... View more

Hi @DiogoFG ,   It looks like a STP design issue.  A say "design" because STP is working, just not as you expected.   The interface shown by "show arp all" is there for convenience.  It is not resolved by ARP but rather reflects the L2 forwarding table of "show mac all". The PA does not participate in STP, but rather forwards the BPDUs to assist in loop prevention.  So, the STP topology looks like SW1=SW2 (the = represents 2 links).  It sounds like once the SW1-PA link goes down, once it comes back up it stays in STP blocking mode.  You can confirm what port is in STP blocking mode on the switch. You should design the blocked port according to desired traffic flow.  If you want the direct link between SW1 and SW2 to always be in blocking state (when all links are up), then adjust your STP cost or priority accordingly on SW1 or SW2. Thanks,   Tom ... View more

Hi @landoa ,   I would upgrade the entire cluster to 9.0.14, then upgrade it again to 9.1.11.   I would not test for the interim version since it is only temporary.  I would implement the full test plan for 9.1.11.  The TAC recommended releases are very stable.   https://live.paloaltonetworks.com/t5/customer-resources/support-pan-os-software-release-guidance/ta-p/258304   Thanks,   Tom ... View more

Yeah, I have noticed that 10.x runs a little slower than 9.x on many firewalls.  I have installed in on a PA-220.  There is a known issue that "PA-220 firewalls are experiencing slower web interface and CLI performance times."  Because of that bug, the CPU spikes and slowness are a lot worse.  However, the data plane seems fine. ... View more

Hi @Dadonis ,   You can have 2 virtual routers with OSPF running in each one.   Thanks,   Tom ... View more

Hi @FWPalolearner ,   The link is fixed now.   Thanks,   Tom ... View more