About pulukas

Palo Alto has an internal Feature Request database that is maintained by the sales Engineers.  You submit your request to them and if it is a new request they create it or they add your companies vote to the existing request.   All requests are assigned a number, FR 1234.   You can then promote the assigned FR number here in the forums to ask others to place votes on the feature.   For your specific needs, there is a user supplied work around outlined in this document.  That uses the Excel XML import feature to pull the policies from the firewall via the API.   https://live.paloaltonetworks.com/t5/API-Articles/Importing-rulebase-into-Excel-using-XML-API/ta-p/57955 ... View more

You have correctly identified the issue of binding with NAT in A/A mode.  When you write a rule it requires you to choose a device.   However, you can duplicate rules and have them on both devices then for the same process.  This is a bit of a pain to double all the NAT rules and a little counter intuitive, but it does work once deployed.  I've used the method a couple years back. ... View more

This general process has been the case at least since PanOS 4 when I started working with PA.     It is unfortunate, but I suppose they do this to simplify the packaging of the upgrade code for the install and upgrade process. ... View more

By default the path out will be via the mgmt interface.  Is this connected to a network that has access to both DNS and internet? ... View more

Looks like only the UK and choose whether or not to have DST enabled.   https://live.paloaltonetworks.com/t5/Management-Articles/Do-Palo-Alto-Networks-Devices-Support-Daylight-Savings-Time/ta-p/58120 ... View more

Thanks for the annual post, but I'm wondering why this years article is posted into configurations when all the historial articles are found in API Articles going back to 2011.   Seems like all should be in the same place for consistency in finding topics. ... View more

Watch for the signature to appear over in the API Articles area where all the historical ones are located.   These will appear after the first games are started because Palo Alto needs to see the actual streams in order to write the signatures that recognize the traffic.  They typically appear the first day of the games and sometimes minor revisions in the following days as needed to fine tune the detection.   https://live.paloaltonetworks.com/t5/API-Articles/tkb-p/TechnologiesSDKsArticles ... View more

In these situations I generally download the PanOS file to my workstation and do the upload and upgrade from there instead of from the cloud.  This will generally get around the issue of communications errors. ... View more

Thanks for documenting the issue for us.   If you have time, please create a support case so the bugs can be offcially reported up to the developers and get fixed in future releases.  You can do this with the "Get Support" button in the upper right. ... View more

I think you are asking if PA NAT supports proxy arp.  If so, the answer is yes and it is automatic.   See page 5 in the Understanding Palo Alto NAT documentation.   https://live.paloaltonetworks.com/t5/Documentation-Articles/Understanding-PAN-OS-NAT/ta-p/60965   Proxy-ARP for NAT Pools   The address pools are not bound to any interfaces. If the address pool is in the same subnet as the egress/ingress interface IP address, the firewall will respond to ARP requests received on that interface for the IP addresses configured in the pool. If the address pool is not in the same subnet as the egress interface IP address, you must configure the necessary routes on the upstream devices in order to ensure the response traffic after address translation is routed back to the firewall. ... View more

Unfortunately, OSPF does require the devices have interfaces in the same network.  You will need to use BGP which does support multi-hop required in this scenario. ... View more

In general, we use OSPF areas in order to keep the database size reasonable in large networks.  so in your case it sounds like you won't have a problem just keeping everything in area 0.   You can use the link cost attribute in OSPF to steer the traffic to prefer the MPLS path over the IPSEC internet path. ... View more