About MikeSangray2019

MikeSangray2019

That's not working. As I noted in my update I have tried setting a custom log. Doing this changes the way the logs are parsed either with pan:config or pan:log. " When I set a custom log format and test changing an object name on the firewall, the logs are parsed as pan:log (not pan:config) and I can see the change detail in the raw event message, but now I've lost the other fields since it was parsed as pan:log." Does anyone have this working? I want to believe this is just something with my config that I can fix, but I haven't seen many posts that this works for others.

Mindtree_Ltd

Try configuring gateway in ha port configuration, pointing one firewall to other.

BPry · ‎12-21-2020

@MikeSangray2019, It's absolutely feasible and something that quite a lot of clients do. If that's what you're looking to do, I would enable it and monitor for any failures in the logs to make sure that you aren't trying to push too many logs, but it should be perfectly fine.

SutareMayur · ‎12-10-2020

Hi @MikeSangray2019 , Apologies for my misunderstanding! As per Palo Alto guidelines, if there is more than one version difference between HA gateways then it gives errors. And the error will be like 'Peer version too old'.

MikeSangray2019 · ‎10-27-2020

I never found a solution, agent downloads are still slow.

Abdul-Fattah · ‎09-17-2020

With API and a small script works perfectly

MikeSangray2019 · ‎09-11-2020

No, actually the PA logs don't display Action for the correlation events like you see for Traffic, Threats, etc. I'm seeing the Action as 'allowed' in Splunk logs. So all correlation events have the action 'allowed'. Just ends up being misleading when reading reports.

MikeSangray2019 · ‎08-06-2020

Thanks, I've been through the guide and I think I'm configuring it correctly, but it's not working. It would be nice to see an example screenshot or two instead of just instructions. For example a screenshot with Step 3 '(Optional) Configure a vendor-specific or custom DHCP option that the DHCP server sends to its clients' would really help to verify syntax.

MikeSangray2019 · ‎05-22-2020

It was switch config. Needed to setup a second port channel on the switches so the interfaces that went to firewall 1 were in a port channel and the interfaces that went to firewall 2 were in their own port channel. This post also helped. https://live.paloaltonetworks.com/t5/general-topics/active-pasive-ha-with-lag-to-virtual-chassis-dropped-packets/td-p/27117#

BPry · ‎03-03-2020

@MikeSangray2019, If you put in a feature request and get the FR ID number let us know so we can have it added to the community feature request list.

MikeSangray2019 · ‎02-14-2020

The EDL entries aren't part of the exportable config via the api and if the IP isn't part of an event it won't show in a SIEM. It does look like you can generate a list using the CLI via 'request system external-list show' so that might be an option for a script or a report?

MikeSangray2019 · ‎01-16-2020

I'm working on this as well. To be clear, this has to be enabled twice in three places. 1) the GUI URL Filtering Profile -> URL Filtering Settings (tab) 2) cli --> > configure # set deviceconfig setting ctd x-forwarded-for yes|no https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClIVCA0 3) create a custom URL Category with your sites listed, apply this custom category to a URL Filtering Profile, and apply the filtering profile to the appropriate security policies This is working for me.

MikeSangray2019 · ‎01-02-2020

Thanks. What kind of latency are you seeing?

Brandon_Wertz · ‎12-30-2019

@MikeSangray2019 wrote: If I download a file does the firewall cache it for a period of time in case anyone else tries to download the same file? So instead of re-downloading the same file from the Internet, the firewall would just serve the cached file for the second download. No, the firewall simply provides the content as allowed by security policy in an established session. Another user, from a different IP address will have a different session. Provided that content doesn't match a malicious hash for "known bad" content that file will be downloaded from the source as many times as requested by a machine requesting it.

MikeSangray2019 · ‎11-15-2019

Perfect, thank you. Answer is at 7:30 in the vid.

Date Registered	‎10-17-2019 12:50 PM
Date Last Visited	3 weeks ago
Total Messages Posted	39

Online Status	Offline
Date Last Visited	3 weeks ago

About MikeSangray2019

Re: Syslog Custom Format for Splunk

Re: Syslog Custom Format for Splunk

Re: HA Configuration on PA-3220 - HA1 is UP but HA1 Backup is Down

Re: Logging to Panorama and Splunk

Logging to Panorama and Splunk

Re: Syslog Custom Format for Splunk

Re: HA Configuration on PA-3220 - HA1 is UP but HA1 Backup is Down

Re: Logging to Panorama and Splunk

Re: HA Upgrade Path 8.1 to 9.1

Re: GlobalProtect agent download speed very slow

Re: Required role to do cli backups

Re: Correlation log subtype action always allowed?

Re: DHCP client identifier 61 return VLAN id

Re: AE Interface State when Connected to Switch LAG

Re: Syslog Custom Log Format

Re: Search EDLs

Re: Reverse Proxy and X-forwarded-for

Re: Dealing with a Google Cloud VPN and setting MTU

Re: Does the firewall cache downloaded files?

Re: HA HSCI 3220

Network Security

Cloud Security

Security Operations

About MikeSangray2019