About TomYoung

TomYoung · ‎10-22-2023

Hello @vdemo-user22 , You will have to open a case by phone. https://www.paloaltonetworks.com/company/contact-support Sometimes the wait is long, and sometimes it is not. Thanks, Tom

TomYoung · ‎10-20-2023

Hi @Sanjay_Ramaiah , Absolutely! There are many, many ways. Look at the details in the pics to see how. You can create a widget under ACC. You can create a custom report. Click Run Now and you will see the results. If you want a more granular custom report, you can change the day to hour. You would need to change the Sort By to Top250 for hours in a week. That view is not as nice as the ACC. If you want a more detailed graph with smaller intervals, you may need to use an NMS and collect the data via SNMP. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClaSCAS You could also use automation and collect the allocated sessions via XML API, "show session info". I didn't see it under Monitor > App Scope. Thanks, Tom

TomYoung · ‎10-19-2023

Hi @MNoble , Looking at this doc, I guess it is not required! https://docs.paloaltonetworks.com/globalprotect/9-1/globalprotect-admin/globalprotect-gateways So, yes, you would configure Internal Host Detection. The internal gateway is optional. I have seen other docs that say if the Internal Host Detection check is successful, the GP client will connect to an internal gateway. I always thought it was required. Regardless, it sounds like you need to fix your connection to the portal. See the URL in my 1st post to resolve that issue. Thanks, Tom

TomYoung · ‎10-19-2023

Hi @MNoble , If you do not have an internal gateway configured, then you are not using Internal Host Detection. This is most likely your issue -> https://knowledgebase.paloaltonetworks.com/kCSArticleDetail?id=kA10g000000Cm65. Do you want your internal users to build an SSL or IPsec tunnel to the NGFW? If not, configure an internal gateway with Tunnel Mode unchecked and configure Internal Host Detection. Then you can use GP for User-ID only. If you do want to build the tunnel, then create the NAT rule as described in the document so the traffic to the portal/gateway is not NATed. Thanks, Tom

TomYoung · ‎10-19-2023

Hi @hfakoor2 , That is good feedback! I have played a little with both. The nicest thing is that in your script you can easily feed the results into ElementTree without having to screen scrape and format the data. Yes, the URL will be the same across all NGFWs. One thing I do not like about both the XML and REST is that the URL is different for different options. I would like the exact same URL and pass different options through the HTTP body. That makes for a more scalable script. Thanks, Tom

TomYoung · ‎10-18-2023

Hi @NickoKristian , Here are your answers: Yes. https://docs.paloaltonetworks.com/compatibility-matrix/supported-os-releases-by-model/palo-alto-networks-next-gen-firewalls#id9680433e-055f-4f38-a7d0-6d31e7d557bc Follow the upgrade path from 9.1 to 10.2 here -> https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-upgrade/upgrade-pan-os/upgrade-the-firewall-pan-os/determine-the-upgrade-path. No. Each NGFW must be upgraded to the next version one after the other -> https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-upgrade/upgrade-pan-os/upgrade-the-firewall-pan-os/upgrade-an-ha-firewall-pair. The NGFWs will remain an HA pair with one PAN-OS major release difference. Two major releases different will cause the older NGFW to enter a suspended state. Yes. Also, do not worry about any mismatches or config not synced errors when the PAN-OS is different. Upgrading the other NGFW to the same PAN-OS usually fixes those errors. Obviously, make sure the config is synced before you begin. Thanks, Tom

TomYoung · ‎10-18-2023

Hi @AhmedAlRashed , It works for me. This URL has instructions for ISE guest, but it works for all authentications -> https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm5sCAC. There is another URL in @raji_toor 's response as well. @jsalmans told you what filters he used to get it working. I use these filters: Event Regex: ([A-Za-z0-9].*CISE_Passed_Authentications.*Framed-IP-Address=.*)|([A-Za-z0-9].*CISE_RADIUS_Accounting.*Framed-IP-Address=.*) Username Regex: User-Name=([a-zA-Z0-9\@\-\\/\\\._]+)|UserName=([a-zA-Z0-9\@\-\\/\\\._]+) Address Regex: Framed-IP-Address=([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}) It works great. It gets wired and wireless. It gets the domain/ma-c0-0a-dd-re-ss of MAB devices. MAB (MAC authentication bypass) will not give you a username because EAP is bypassed. If someone wants something more descriptive for devices, they may look into Device-ID. Thanks, Tom

TomYoung · ‎10-18-2023

Hi @chens , Okay. Good. You can delete the device group, template and template stack in Panorama and start the process again. Since the commit failed on the NGFW, you should be able to load last saved configuration and start again. This time do not make any changes before the push and export. Also, the load device state is not required. Follow the steps in the document, and you should be good to go! Thanks, Tom

TomYoung · ‎10-18-2023

Hi @hfakoor2 , Did you use an SSL/TLS Service Profile to attach the certificate to the web UI (Panorama > Setup > Management > General Settings > SSL/TLS Service Profile)? Thanks, Tom

TomYoung · ‎10-18-2023

Hi @hfakoor2 , Well done! You are now using the XML API! That is a very nice script! If someone were going to use your script in production, then I would store the username and password (or API keys) in local environment variables and not the script. That is not required, but definitely a best practice especially if they use Git or another development platform where the code is shared. Your scripts have the default usernames and passwords. So, no sensitive information is exposed in your example. Thanks, Tom

TomYoung · ‎10-18-2023

Hi @chens , Okay. Your issue is a whole lot more than what you originally said. Are you adding a new NGFW to Panorama? The only time that you should do step 5 (Panorama > Setup > Operations > Export or push device config bundle) is when you are adding a new NGFW to Panorama and you want to import the standalone configuration. If you are adding a standalone NGFW to Panorama, did you import the NGFW config into Panorama (step 4)? If yes, then do NOT make any changes to the configuration before step 5. If you are not adding a standalone NGFW to Panorama, then please do NOT use the term export. It's just push. Thanks, Tom

TomYoung · ‎10-17-2023

Hi @chens , This is something that is not explained very well in the documentation. Step 5 in the URL below, Export or push device config bundle, deletes the local Policies and Objects (device group configuration) and adds the Panorama pushed Policies and Objects. Your template values are not changed. Step 6 in the URL below, Commit to Panorama then Commit > Push to Devices, will override the local Network and Device configuration (template values) IF the Force Template Values box is checked. This should be done with care because you could override IP addresses, routes, etc. The NGFW is smart enough not to change the management interface configuration or host name. Generally this should be done only once on the first push after the export/push. https://docs.paloaltonetworks.com/panorama/9-1/panorama-admin/manage-firewalls/transition-a-firewall-to-panorama-management/migrate-a-firewall-to-panorama-management Thanks, Tom

TomYoung · ‎10-16-2023

Hi @OersPrintMedia , This table -> https://docs.paloaltonetworks.com/compatibility-matrix/globalprotect/where-can-i-install-the-globalprotect-app shows which versions will work on MacOS 14 (Sonoma). I am pretty sure PANW would not add those unless they were tested. You are right to check before upgrading! I always wait a while before upgrading my Mac because I use a lot of applications, and I want to make sure they all will work. Thanks, Tom PS If you click on the drop down in the upper right, you can edit your post.

TomYoung · ‎10-12-2023

Hi @AndrewBytes , Correct. My portal login page is disabled, and GP works fine. The bots irritate me, too, or they did. 😀 Thanks, Tom

TomYoung · ‎10-12-2023

Hi @Indranil-Chowdhury , If you are not able to discern the error in your code output, I can't help you. I did provide you with the XML URL to upload a page, which you requested. You could try to use curl or Postman to verify the URL works outside of your script. Thanks, Tom

Member Since	‎11-15-2017 11:37 PM
Date Last Visited	‎04-26-2024 01:20 AM
Posts	1,142
Total Likes Received	464

Online Status	Offline
Date Last Visited	‎04-26-2024 01:20 AM

Unlock your full community experience!

About TomYoung