About kiwi

    Exciting new Cortex Data Lake updates are here! Y ou’ll now be able to take advantage of the onboarding, quota management, exploring, and log forwarding functionality in one consolidated Cortex Data Lake application.   This upgrade has the following changes: The Quota Manager app functionality has moved into the Storage tab. Select Configuration and adjust the storage allocated for each log type. The firewall onboarding functionality from the Quota Manager app has moved under the Devices tab. Here you can view your available Panorama and firewall devices or generate onboarding keys for them. Explore app functionality has moved into the Explore tab. Search, filter and export logs directly within the Cortex Data Lake app. Log Forwarding app functionality has moved into the Log Forwarding tab. The Log Forwarding interface now has a new, simplified design that makes it easier to configure Syslog and email profiles to forward your Cortex Data Lake log data.       We’re here to answer any questions you may have about this new Cortex Data Lake evolution, and check out the latest TechDocs for even more info.   Thanks   for taking time to read this blog. Don't forget to hit the   Like (thumbs up)   button and to   subscribe   to the   LIVEcommunity   Blog area.   As always, we welcome all questions, comments and feedback in the comments section below.   Kiwi out!   ... View more

  Hi everyone,   With today's blog I would like to highlight some of the new and updated features in PAN-OS version 10.0.3.   Prior to upgrading, I would recommend checking out the release guidance page or reaching out to your Professional Services or Focused Services account manager for a more tailored release guidance.   New and updated PAN-OS 10.0.3 features* FEATURE CHANGE Multiple APNs on S11 interfaces for RAN deployments In PAN-OS 10.0.2 and earlier, all access point names (APNs) from the same user equipment (UE) shared a single GTP-C tunnel on an S11 interface. In PAN-OS 10.0.3 and later, the firewall supports multiple APNs on an S11 interface for RAN deployments by creating separate sessions for multiple APNs. By dividing the GTP-C tunnel into multiple sessions, the firewall now processes each APN independently. Scheduled Reports for Cortex Data Lake (PAN-OS 10.0.3 or later) Beginning with PAN-OS 10.0.3, support for scheduled reports on Cortex Data Lake data is now enabled by default. IKEv2 Support for AES-GCM Encryption ( Available with PAN-OS® 10.0.3 and later 10.0 releases ) Security-conscious customers in financial verticals and other markets who have VPN deployments are standardizing on strong IKE and IPSec security and require PAN-OS firewalls to support AES-GCM (Advanced Encryption Standard with Galois/Counter Mode). PAN-OS firewalls now support two new encryption algorithms for IKEv2 crypto profiles: AES-GCM with 128-bit strength and AES-GCM with 256-bit strength to provide compatibility with other devices and to provide stronger security than AES-CBC (AES with Cipher-Block Chaining). * - New features taken from Changes to Default Behavior and Networking Features    More Info   For even more info on PAN-OS, new features, default behaviors, Known and addressed issues, please see the release notes page here: Version 10.0 Release Notes    Thanks   for taking time to read this blog. Don't forget to hit the   Like (thumbs up)   button and to   subscribe   to the   LIVEcommunity   Blog area.   As always, we welcome all questions, comments and feedback in the comments section below.   Kiwi out!   ... View more

  In this week's Discussion of the Week, I would like to take some time to go over Aged-Out Session End, because it's a pretty popular topic in our discussions area on LIVEcommunity.     Below is the link to said discussion and I added some extra links that cover the same topic: https://live.paloaltonetworks.com/t5/general-topics/session-end-reason-tcp-fin-and-aged-out/td-p/245833 https://live.paloaltonetworks.com/t5/general-topics/aged-out-in-allowed-traffic-logs/m-p/295534 https://live.paloaltonetworks.com/t5/general-topics/seeson-end-reason-aged-out/td-p/78997   In these discussions, the different users were all looking for some clarification on the session end reason "aged-out."   This type of end reason could actually be perfectly normal behavior depending on the type of traffic.   It is something that is to be expected for services using the UDP protocol. For example, services like DNS, DHCP, NTP and SNMP use UDP and can be considered unreliable because the protocol doesn't offer a guarantee that the data is actually delivered correctly, which is an advantage with services using TCP.   Similarly a simple PING can also return an aged-out session end. As you might know (or not), PING doesn't use TCP or UDP. It uses ICMP which is also a stateless protocol like UDP.   So for these kind of services or protocols, it could be considered normal behavior to have a session end reason "aged-out."   For services using TCP however, having a session end "aged-out" might not be considered normal and further investigation is required. The reasons can be many. Here are just a few examples:   The destination server might not have an open port on the requested service The receiving end might return traffic over a different path (asymmetric routing) Your access can be blocked by a remote FW or access list There might simply be a network path issue in-between   This often goes hand-in-hand with application showing as 'Incomplete' in the traffic logs. In that case, you might want to first check if your packets are correctly leaving the firewall. You can do a PCAP to make sure. Also a good indication is the 'Packets Sent' count in the traffic log. You can check the 'Packets Sent' in the traffic log details or you can add up the columns, as displayed below.       Once you've confirmed that packets are correctly leaving the firewall, you should check the behavior (if you can) on the remote end. Is your request even reaching the remote end and if so, how is it being handled? Is it being blocked and is the server sending a response back? Is traffic returned using a different path?   More Info   Getting Started: Packet Capture Session Tracker Feature  Why do some traffic report as aged-out in traffic log  Not-Applicable, Incomplete, Insufficient Data in the Application Field      Thanks   for taking time to read this blog. Don't forget to hit the   Like (thumbs up)   button and to   subscribe   to the   LIVEcommunity   Blog area.   As always, we welcome all questions, comments and feedback in the comments section below.   Kiwi out!   ... View more

    We regularly receive queries about what's supported or where agent X can be installed. These type of questions reach our support team and, at times, are even posted right here on the LIVEcommunity discussions area.   Below are just two of the more recent queries as an example: GP Not Compatible For MAC-OS Big Sur Version11.0  MAC-OS Big Sur Support    This blog highlights the Compatibility Matrix (CM) page, where you can find the answers to these type of questions. Note that the two examples provided are related to GlobalProtect (GP) compatibility, but I would like to emphasize that the compatibility matrix is not only limited to that topic.    The CM page is updated regularly and is divided into several topics that cover GP compatibility, Supported Cipher Suites, Supported OS releases, Panorama Plugin versions and many more topics!   Topics covered on the CM page are divided as follows: Supported OS Releases by Model - determine support for Palo Alto Networks Next-Generation Firewalls, appliances, and agents. VM-Series Firewalls - The hypervisors and the public cloud regions in which you can deploy the VM-Series firewalls Panorama - information about Panorama and compatible versions for devices that Panorama can manage, as well as about plugins that are available for Panorama MFA Vendor Support Supported Cipher Suites - determine support for cipher suites according to function and PAN-OS software release. GlobalProtect - support information for the GlobalProtect app Prisma Access - support information for Prisma Access User-ID Agent - support information for UID-Agent & UID Credential Service Terminal Server (TS) Agent - support information for the TSA Cortex Data Lake - Cortex Data Lake Software Compatibility Cortex XDR - support information for Cortex XDR & Traps IPv6 Support by Feature - review PAN-OS features that support IPv6 traffic Mobile Network Infrastructure Feature Support - firewall models that support GTP Security and SCTP Security.   Check out the CM page HERE or download the PDF in order to find the information you're looking for!   Thanks   for taking time to read this blog. Don't forget to hit the   Like (thumbs up)   button and to   subscribe   to the   LIVEcommunity   Blog area.   As always, we welcome all questions, comments and feedback in the comments section below.   Kiwi out! ... View more

  Just in case you missed it, our very own Cheryl Rasmussen took some time to interview one of our new Cyber Elite Members, Brandon Pry (@BPry) .   Take a moment to check out Cheryl's blog and watch the video interview here: https://live.paloaltonetworks.com/t5/blogs/spotlight-interview-with-bpry/ba-p/373666   Super happy to have you on board in the LIVEcommunity Brandon !   Cheers ! -Kiwi.   ... View more

In today's blog, I will go over the information and spread the good news about an important service offering. Because who doesn't love saving money while also having the best available service at your command?   Palo Alto Networks' CloudGenix SD-WAN is a cloud-delivered service that implements app-defined, autonomous SD-WAN to help you secure and connect your branch offices, data centers and large campus sites without increasing cost and complexity. The AppFabric connects your sites securely with application awareness and gives you the freedom to use any WAN, any cloud for a thin branch (security from the cloud) solution.   Check out the LIVEcommunity CloudGenix SD-WAN portal where you'll find discussions, videos, blogs and other resources related to CloudGenix SD-WAN. Ask your questions and participate in the discussions or browse around to find the information you're looking for!   CloudGenix SD-WAN on LIVEcommunity   Note: The CloudGenix Support Portal has been successfully transitioned to the Palo Alto Networks Support Portal: Palo Alto Networks Support Portal   Partial Shipments: The ability to manage CloudGenix partial product shipments has been added to the Palo Alto Networks Customer Support Portal. With this you have control over the management of partial product shipments.   For partial shipment orders that are in process during this transition you will need to access the Palo Alto Networks Support Portal to complete any partial shipment processing.   The following knowledge base article provides details on how to process partial shipments. Currently partial shipment is only available for US domestic locations with support for international locations to be provided in the near future.   CSP Super Users: Each customer account on the Palo Alto Networks Support portal is assigned a support portal Super User. The Super User can authorize the contacts that will have access to open cases or manage existing cases.   Please see this   knowledge base article   for more details.   Additional Information: Customer Support Resource Guide How to Open a Case If you are experiencing any access issues, please contact support or visit the Login Assistance page.   NOTE: The email support@cloudgenix.com will no longer be available for case creation or monitoring. Please use the Palo Alto Networks Support Portal or reach out to Support if you would like assistance.   More information on CloudGenix: CloudGenix SD-WAN on LIVEcommunity  CloudGenix SD-WAN in Action Demo   CloudGenix SD-WAN  Cloudgenix SD-WAN TechDocs    Thanks   for taking time to read this blog. Don't forget to hit the   Like (thumbs up)   button and to   subscribe   to the   LIVEcommunity   Blog area.   As always, we welcome all questions, comments and feedback in the comments section below.   Kiwi out! ... View more