About pulukas

You are correct that you cannot run CLI for the devices from Panorama. For the load partial scripting, I've generally imported the xml config file into the device or panorama as a file on the setup > operations menu.  then you can reference the file name in your load partial commands so you don't have the buffer issue.  The technique is outlined in the Panorama import documentation. Panorama Device Migration ... View more

Seems like you have the concepts down.  Panorama is primarily about setting up the common settings that can be pushed to multiple devices via the groups.  The general assumption is that specific site only settings are on the device. With version 7 and the template stack you could use a specific template as you suggest for each site.  But I think that is going to make your Panorama interface very busy with a very long pull menu on 100 sites.  Personally, I would stick with keeping the specific settings local and just changing the context to local in Panorama for maintenance. You are also correct that scripting will be your best bet to pre-load the configuration itself either on the device or via your Panorama specific device template. ... View more

Yes, once you setup this section it is comprehensive on both exclude and include networks. ... View more

On the bottom of the User-ID setup screen you can enter exclude addresses that will be ignored for user-ID. ... View more

Welcome to PanOS. The zone protection profile on PanOS combines the same features as the SRX functions host-inbound-traffic screen ... View more

Do you get the domain information from the ACS logs or just the user name? ... View more

From your testing plan, it would appear to me you have discovered a bug. Your best bet is to report this via a ticket to support with the link in the upper right corner.  They can determine if this is known or not already and get you a hot fix even before the official release when it is available. ... View more

I'm not sure what exactly this counter counts.  But based on the information you have here I would probably agree with you that it may indicate some kind of issue. Your best bet is to open an official ticket using the support link in the upper right side.  These are unofficial community support forums. ... View more

My experience with vrouter changes is that they are disruptive.  They appear to delete and then recreate the affected vrouters. I would expect all sessions to be lost and need to re-establish after this commit takes place and would plan for a session impact change window. ... View more

I appreciate that the Migration tool is now available to the general user base and not just Palo Alto partners.  The tool is not a full service conversion but a help along the way. Three years ago as a customer I asked to get a copy of this for our internal use and the answer was no.  Only Palo Alto professional services and partners were allowed to access the tool for their work. Now I'm happy that this is at general availability.  Even with the issues this saves time in working on large configs. ... View more

So to increase the length of time you have detailed logging you have two options that will help. Assign Panorama a maximum sized logging partition. Reduce the number of logs you generate by only logging rules and parameters you will use. ... View more

In order to block traffic you would need to be in-line as you indicate. Palo Alto can be setup using a span port and the PA interface as a Tap.  But you can only report on traffic then you cannot block anything as you are only seeing a copy of the traffic not the actual flow. ... View more

Are you setting this up with an existing firewall and inserting this in the path for URL filtering? If so, you can use the v-wire instance that exists by default on most models.  This will insert on the trust side of your existing firewall to read all the outbound traffic. Create two rules: untrust to trust with allow all trust to untrust with allow all and add your url filtering profile to this rule I would also add a basic threat profile so you can get logging on this as well. ... View more

PAN does not announce timelines or future releases in public forums.  You will need to either open a ticket or contact your Sales engineer to get this type of information, if it is available. Or watch the Threat database with your CVE search. https://threatvault.paloaltonetworks.com/ ... View more