Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Get Started
- News & Events
- Collaboration
- Education Services
- Technologies
- Next-Generation Firewall
- GlobalProtect
- Threat Prevention Services
- Endpoint Protection
- 5G/IoT
- Prisma SD-WAN
Network Security
- Prisma Access
- Prisma Access Insights
- Prisma SaaS
- Prisma Cloud
- CN-Series
- VM-Series:
- Alibaba
- AWS
- GCP
- Azure
Cloud Security
- Cortex XDR
- Cortex XSOAR
- Cortex Data Lake
Security Operations
- Resources
- COVID-19 Response Center
- LIVEcommunity
- ›
- About MikeSangray2019
About MikeSangray2019
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
3 weeks ago
39Posts
0Likes
0Solutions
Feb 10, 2021Last Visited
User
Activity
User
Profile
Latest posts by MikeSangray2019
| Subject | Views | Posted |
|---|---|---|
| 114 | a month ago | |
| 178 | a month ago | |
| 533 | 01-15-2021 11:47 AM | |
| 300 | 12-21-2020 07:01 AM | |
| 413 | 12-17-2020 01:05 PM |
User Badges
Public Statistics
| Date Registered | 10-17-2019 12:50 PM |
| Date Last Visited | 3 weeks ago |
| Total Messages Posted | 39 |
a month ago
That's not working. As I noted in my update I have tried setting a custom log. Doing this changes the way the logs are parsed either with pan:config or pan:log. " When I set a custom log format and test changing an object name on the firewall, the logs are parsed as pan:log (not pan:config) and I can see the change detail in the raw event message, but now I've lost the other fields since it was parsed as pan:log." Does anyone have this working? I want to believe this is just something with my config that I can fix, but I haven't seen many posts that this works for others.
... View more
a month ago
Closer, but still seeing an issue. Firewall config events are being parsed as pan:config, but without before and after change details. Other details are included, but before and after change details are both 0. When I set a custom log format and test changing an object name on the firewall, the logs are parsed as pan:log (not pan:config) and I can see the change detail in the raw event message, but now I've lost the other fields since it was parsed as pan:log.
... View more
01-15-2021
11:47 AM
Same issue on a pair of 3320s. Rebooted the passive firewall, but no change, still red.
... View more
12-21-2020
07:01 AM
So Option 2 sending to both Splunk and Panorama is feasible and not a strain on the firewalls? If so, then this is the option I'm leaning toward since it would help provide another layer of redundancy for log shipping.
... View more
12-17-2020
01:05 PM
I am standing up Panorama and not sure where to send logs. I currently have my firewalls sending logs to Splunk via a syslog server, and I want to keep getting logs into Splunk. Is there a best practice or recommended config? Option 1. Send firewall logs to Panorama and then from Panorama to Splunk Option 2. Configure firewalls to send to both Panorama and Splunk Option 3. something else?
... View more
12-10-2020
09:46 AM
I understand the path, my question is about HA. Can I upgrade one of the firewalls all the way to 9.1 and then upgrade the second firewall to 9.1 or do I have to do one to 9.0, then the second to 9.0, and then upgrade to 9.1 on the first and then 9.1 on the second.
... View more
12-10-2020
07:44 AM
I have an HA pair of firewalls on 8.1. Do I need to upgrade both to 9.0 and then 9.1 or can I upgrade one all the way to 9.1 and then the second from 8.1. to 9.1?
... View more
10-27-2020
02:37 PM
I never found a solution, agent downloads are still slow.
... View more
09-17-2020
02:24 PM
The GUI was a limiting factor in this scenario, but thanks for the information. We're after an automated solution, so maybe Panorama or API.
... View more
09-15-2020
01:59 PM
Do you know if the output of 'show config running' in an xml file can be used to restore the config?
... View more
09-15-2020
09:40 AM
What are you saying here? Are you saying that if the config is exported as XML that there is no ability to restore it? " So, to summarize, there does not seem a good ability to load a config in "set" notation, but could export with 1000s of lines as XML."
... View more
09-11-2020
09:12 AM
What about using a tool like CatTools to capture the output of 'show config running' ? The readonly permissions lets the user run this command.
... View more
09-11-2020
08:43 AM
No, actually the PA logs don't display Action for the correlation events like you see for Traffic, Threats, etc. I'm seeing the Action as 'allowed' in Splunk logs. So all correlation events have the action 'allowed'. Just ends up being misleading when reading reports.
... View more
09-10-2020
09:14 AM
Is the correlation log_subtype action always allowed? It creates a bit of confusion when the action on the actual event was blocked, but the correlation action shows allowed. Just looking for clarification.
... View more
09-10-2020
08:17 AM
We have a process to do backups using the cli. I'm going to create a new role restricted to cli for this purpose. What admin role is required to perform backups?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
3 weeks ago
|
Latest Tags
No tags yet
Latest Blogs
Latest Posts
Copyright 2007 - 2021 - Palo Alto Networks
