About pulukas

On your VMware host you create the vSwitches needed to segment the network.  then connect the servers and PA interfaces to these vSwitches for your desired zone layout.   https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-Interfaces-for-VM-Series-to-Work-in-L3-without/ta-p/55969 ... View more

If there is no spanning tree port status change, then this does have to be a bug.  The mac move should not occur in that scenario. ... View more

If your users authtenticate to wireless using RADIUS or 802.1x you can also forward this authentication messages to the PA for user id mapping using the sys log receiver.  Some common wireless authentication have instructions tested and posted if you search for your brand in the "Topics" area here. ... View more

Is your issue solved?  If not:   From what you list here, it looks like the VPN from B will not allow traffic with an ip address of C to enter the tunnel and the same seems to be the case in reverse.  Your tunnels only seem to capture traffic for the A subnet to these sites.   There would be two basic options:   1-add the missing subnet to both tunnels (proxy-id pairs) so that traffic will be accepted by the tunnels and forwarded through both.  This requries changes to all three VPN setups.   2-NAT the traffic between B and C.  On the side where the sesssion is initiated NAT the destination to an available address at site A.  On site A NAT this address back to the original for the site and forward it on to the existing tunnel. ... View more

If you want to load balance then your options are to use ECMP (if you have PanOS 7 where this feature was introduced) or configure policy based routing.  With policy based routing you choose what types of traffic by source or other criteria to forward to which ISP.   ECMP ECMP Load-Balancing Algorithms Configure ECMP on a Virtual Router Enable ECMP for Multiple BGP Autonomous Systems   Policy Based Routing ... View more

Can you confirm that spanning tree is not enabled on the Nexus ports and potentially moving to blocking on the active link port.   If there is no spanning tree, then TAC is correct no mac migration should occur outside of a bug in the PanOS causing the passive device to arp this address.  the packet captures should confirm the exact behavior. ... View more

In general this type of informtion is on the upgrade tech note for the version.  In the case of the 7.0 train here.   https://www.paloaltonetworks.com/documentation/70/pan-os/newfeaturesguide/upgrade-to-pan-os-7-0   Your description is vague but you might be refering to issue 47584 SSL/TLS serivce profiles mid way down this page with a link to the details here.   https://www.paloaltonetworks.com/documentation/70/pan-os/newfeaturesguide/authentication-features/ssl-tls-service-profiles#47584     ... View more

If you company does not have licensing for this in the portal you can discuss your lab needs with your SE and obtain non-production VMs via this channel as well. ... View more

I second the desire for a searchable bug database.  This makes migrations and upgrades easier to select the right version of code for the particular configuration applied.   This can also let us find the right upgrade path to fix an obvious bug we hit on our own without needing to open a ticket and wait in the queues for support to search for the bug. ... View more

I assume you are talking about source nat for internet access.   Then the proxy should not be an issue for applying nat because that will be a destination address for the proxyed traffic and not affect nat at all.   What you would need to know is the nat address pool range or an interface ip address that will be used for the nat on the PA.   You could assume that any source address coming in will have nat applied or if not, then you would need to know what ip address ranges to place in the nat rule to apply the source nat. ... View more

Could you provide the link to the original source document for your quoted paragraphs?   I'd like to see the full context that might help explain the apparent contradictions. ... View more

Sounds like you are hitting one of the ALG setups probably a VOIP one.  What do the logs say for the permitted traffic? This might help see what needs to be turned off or put in for override. ... View more

Check out the information on the main PA Learning center.   https://www.paloaltonetworks.com/services/education   You become either a training partner or an Academy depending on your program desires.   There are also blogs and general information here, mostly on the academy program.   https://live.paloaltonetworks.com/t5/Learning/ct-p/Learning     ... View more

Can't seem to find the client to DC article.  But here are the ports I pulled when setting this up a few years back.   53/tcp and 53/udp (only if the DC is also the DNS source) 749/udp 88/tcp/udp 389/tcp/udp 3268/tcp  445/tcp/udp 123/udp 135/tcp tcp random range: 49152 to 65535 ... View more