About pulukas

I've occasionally seen this same message in 6.0.6 and the function works a few minutes later. ... View more

Yes, Palo Alto can mitigate this type of attack.  You can see the general deployment recommendations in these documents. Understanding DoS Protection Application DDoS Mitigation ... View more

Thanks for the update.  That is a strange issue. ... View more

PAN does not publish this type of information publicly.  Contact your Sales Engineer and you can see some of this with a NDA (non-disclosure agreement) with your company and PAN. ... View more

Be sure to contact you Sales Engineer and vote for the reference FR 1050 above.  Votes on the FR database help push features up in the release cycles.  Your vote does count but you have to contact your PA Sales engineer and get it registered. ... View more

This depends on how you do the load balancing.  If you need the PA to do the load balancing for the active/active then you will need to use one of those two methods and the extra ip addresses. But if the link load balancing occurs upstream or using routing protocols through the two links, then only the two interface addresses are required and not any of the floating addresses. ... View more

I believe this only applies to debug logs.  Have you setup a debug using those linked instructions and the expected file name? ... View more

What does the system log show for the first failed login attempt? ... View more

Glad to hear all went well.  We like the uneventful cuts. ... View more

To manage them in Panorama you would add both nodes.  Then use the check box option in the managed nodes list to group HA pairs. If the configuration is not syncing, that is probably a separate issue.  You do normally update one device and then they sync.  This is why Panorama keeps track of which devices are pairs.  go to the system log and find the reason for the sync failure.  There are a number of error codes and each has a solution article setup depending on why the sync is failing. ... View more

Yes, this is a way to get user ip mappings via syslog directly. Since this is not connected there is either a configuration issue on one side, or the traffic is not reaching the PA. Do you have a way to run a span port on the PA side to confirm the syslog data is arriving? ... View more

You can check your configuration and test the syslog receiver with the instructions here. How to Configure a Custom Syslog Sender and Test User Mappings ... View more

For traffic like iSCSI your best bet is to get this into a segregated vlan that does not transit routers and firewalls if at all possible. If it must transit the PA, create an application override to improve performance and insure there is a little latency as possible on this traffic. ... View more

You cannot control the partition usage.  But the rollback process is pretty simple in the gui. When I do major release upgrades, I generally create a snapshot and download this prior to the install.  This is a fallback in case the upgrade goes badly or needs to be rolled back.  The upgrade process itself does create and use these configuration snapshots automatically.  But I like to have a manual one as well. In running upgrades across major release, I generally rollback about one in five times because we hit some kind of anomalous behavior.  But the most recent moves from 5 to 6 have all gone well on the firewalls.  I did hit a bug in Panorama upgrades from 5 to 6 but that was an edge case pretty specific to the configuration. ... View more