About SutareMayur

@MGattiOh so you are trying to configure sub-interface on aggregate interface. Just few questions,  ae1 interface was already created and now you are just trying to add sub-interface under it? - In this case, delete ae1.151 sub-int, commit changes. Then again re-create interface and try to commit changes.   If you have just now created a1 sub-int and simultaneously adding sub interface under it. I will recommend you to try to push   ae1 interface config first then post successful commit, try to add sub-interface under it. ... View more

@MGatti,   To create new interface through Panorama, you just need to Add Interface and select slot 1 and then under drop down it shows you the interfaces which are available and not yet created yet. Normally you will select Slot 1 unless you have higher model firewalls like 7000 series firewall. Please refer below snap.   Can you verify the interface number you are trying to add from Panorama and the number of interfaces on the firewall ? Check number of available interfaces on the gateway and according to the availability  on the gateway, add respective number interface from Panorama.   ... View more

@sabi4evr_com,   From switch side also, you need to create port aggregation/channel of the interfaces that are going to be terminated on the firewall. So on both end devices (switch and Palo Alto), you will have port channel/aggregation of the interfaces. This is the same the way  we provide uplinks between two switches through port/ether channel. ... View more

@Mohammed_Yasin,  yes you can download the required version agent from Palo Alto support portal from Software Updates tab. ... View more

@Alex_Samad,   Normally you need multiple VRs to have a separate set of routes which you do not want to share between VRs, also you can configure different routing types for different interfaces. As explained by @Abdul-Fattah , If you want to reach subnet on VR1 from the subnet on VR2, you can add static route on respective VRs and mention next hop as a NEXT VR. Yes you can also have OSPF or BGP neighborship between two VRs. Below are ref. articles.   https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Clz7CAC#:~:text=OSPF%20can%20be%20used%20for,static%20routes%20to%20its%20neighbor.   https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClIpCAK         ... View more

@herman2018Yes it means your device do not have valid license for the said services/feature. You should be able to see all the current activated license on the device on this path --> Device tab --> Licenses   Now, you tried to " retrieve the license key"  licenses from license server. For this, you need to have valid auth-code for the feature subscription and that should be activated on the support portal.   Whenever you purchase any additional Palo alto feature e.g. threat prevention, you get the Authorization Code for that  subscription. To enable that feature you can either activate it on support portal first then retrieve it on the gateway or you can directly activate service using Auth-Code on the gateway itself.     ... View more

Hello @Umakant    You can use below syntax to get the required data using API.   https://<IP-Address>/api/?type=log&log-type=system&query=(eventid eq globalprotectportal-config-succ)&key=<api-key>   Now I have put query equal to event log - globalprotectportal-config-succ. You can mention here the exact query in above syntax that you are matching in the system logs on the WebUI. Once you query it, you will see result as shown below.   <response status="success" code="19"> <result> <msg> <line>query job enqueued with jobid 783</line> </msg> <job>783</job> </result> </response>     Now you get the job id. Using that job id you need retrieve the required data using below API query. In place of job id, you need to mention the id that you're getting (In above case, it is 783). Once query is successful, you will get the desired information.   https://<IP-Address>/api/?key=apikey&type=log&action=get&job-id=<id>   You can even try same using Reports. I personally never tried it but i think, it should also work as per your requirements. You can defined Custom Reports for Global Protect. And see the  report using below syntax.   /api/?type=report&async=yes&reporttype=custom&reportname=<Report-Name>   Hope it helps!   ... View more

@danielmartins  If you have large block of public IP address which will send internet request traffic as a source, then yes  you can add security policy for allowing whole range/scope as a source or you can also add address group under security policy. You should be good with any of the two ways. ... View more

Hi@danielmartins  Initially when i started working on Palo Alto devices, i had also came across same situation. I was concerned about traffic which was matching between (outside to  outside) zone due to intrazone default rule. As rightly said by you, although there is nothing behind those matching public IPs (as no NAT rule defined) still i had blocked it by adding security policy which will block traffic from outside-to-outside zone and yes, it also blocked internet traffic from external interface. So to avoid this, i did below things.   I had added new security policy before existing outside-to-outside zones blocked security policy and allowed any internet from my external public IP address. I had to add this security policy as there were internet dependencies as given below from my external interface. a. I had few tunnels from my same firewall, so due to outside-to-outside zones security policy, it may have brake my communication between  my external interface and the remote end peer public IP.   b. I had some path monitoring enabled on my external interface so this also may have brake that path monitoring.   So to avoid this, i had added one more security policy mentioned in point 1 before outside-to-outside zones blocked security policy.   With this, i was all set. It didnt broke my internet communication from external interface, also it stopped matching intrazone default policy for traffic outside-to-outside zone.   I will also recommend you to allow internet if you really need it from external interface. Otherwise, if in future you have requirement of tunnel (just an example), you will have to add policy at that time to allow communication with remote end peer. Currently if you do not have any dependencies on internet reachability from external interface, you should be good then. But you should remember to make necessary changes if you got any such requirement in future.   Hope it helps!   ... View more

@OsamaKhan, You should be able to see logs related to installing GP client on the gateway under system logs. You should see logs like - Installed gpclient software <version>.   You will also get HA related logs under system logs. Hope it helps! ... View more

@Jimmy20,   TCP RST flag may be sent by either of the end (client/server) because of fatal error. So if you take example of  TCP RST flag,  client trying to connect server on port which is unavailable at that moment on the server. Now for successful connections without any issues from either of the end, you will see TCP-FIN flag.   Now in case, for a moment particular server went unavailable then RST will happen and user even don't  know about this situation and initiated new request again And at that time may be that server became available and after that connection was successful. So In this  case, if you compare sessions, you will find RST for first session and 2nd should be TCP-FIN. So like this, there are multiple situations where you will see such logs.     ... View more

@Jimmy20, Normally these are the session end reasons. Now depending on the type like TCP-RST-FROM-CLIENT or TCP-RST-FROM-SERVER, it tells you who is sending TCP reset and session gets terminated. It does not mean that firewall is blocking the traffic. It means session got created between client-to-server but it got terminated from any of the end (client or server) and depending on who sent the TCP reset, you will see session end result under traffic logs. And once the session is terminated, it is getting reestablish with new traffic request and  thats why not seeing as such problems with the traffic flow. If you want to know more about it, you can take packet capture on the firewall. ... View more

@AmirSabei,   Kindly refer below article. This may help you.   https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PMvgCAG   Mayur ... View more

@Yaswanthchowdary007,   First, you should have valid URL filtering license? If you have license, what are you seeing under traffic and url filtering logs? Please check if dropbox is getting blocked due to any custom URL category. ... View more

@orkun.yalcin, Then how are they connected? ... View more

@FelixcaoThat belongs to Panorama login. As your gateway is connected to Panorama, so Panorama is logged in using that ID on the gateway. That From IP will be your Panorama IP address. You will find such login under 'show admins' on each gateway which is integrated with Panorama. ... View more

@Felixcao,   From the below output. it seems you are seeing "show admins" on the gateway cli as client shown is Panorama. Now here is the case,   As some of the users are logged into Panorama server using userid 'admin' so it is showing admin as Panorama-admin on the firewall Dashboard/cli. This is expected. This does not mean you have some user configured as Panorama-admin, it is only indicating on gateway side that there is someone logged on Panorama using id admin (Panorama-Admin). If you configure new userid like Admin1 on the Panorama and someone is logged in using this id on the Panorama then on the gateway side you will find Panorama-Admin1 under show admins command/ on dashboard. You can verify it with other firewall instances as well which are connected to Panorama.   You are seeing multiple login entries using Panorama-Admin because there are multiple login using admin userid on the Panorama. ... View more

Under Panorama dashboard widgets, you can see admin userids who are logged in right now. I dont think if you can see their roles under dashboard. If you are seeing below accounts under widgets, then those must be the custom user ids defined under Panorama to login. You can check it under Panorama tab-->Administrators tab. ... View more

@simsim ,. Which subscription are you talking about?   If you are talking about specific subscription like Threat prevention then if it gets expired, then firewall will take required actions on existing signatures, only new signature wont get updates with expired license.   If you are talking about support license, then if it gets expired, firewall continue to work as it is based on its capacity, only new software updates wont be available.   In any of the case, it wont affect the firewall performance based on it's capacity including interface bandwidth. ... View more

@infoit,   First, as your traffic from public (UNTRUST) will hit the site A public IP address (NATTING to Site B web server), then travel cross internal connection to web server in Site B DMZ so traffic towards SITE-B firewall will come up with source zone as trust as it is traveling via your internal interface (trust) connected between both firewalls.   Now the source will be public IP so you need to check routing for those source public IP addresses on SITE-B Firewall. Most of the times on the firewalls, default route is set to external interface. Due to this route, the response from DMZ server at Site-B will go towards external interface (as it will match default route).   I think, this is creating problems. I can suggest few pointers -   1. If you know the source public IP addresses/networks, make proper routing on SITE-B firewall so response will go through proper path. Not sure if you would have these details as most of the times we are not aware of all public source IP addresses unless whitelisting is done.   2. You can NAT source IP address of traffic initiator on SITE-A Firewall. So if you NAT source public IP with any internal IP address (can be trust and known to SITE-B). So all the request will come from single source on SITE-B Firewall.  But with this, you won't be able to see actual client IP address om DMZ end. ... View more

@orkun.yalcin  How your DC firewall is connected to ATM firewall ? If it is over dedicated interface then you can have dedicated zone on the interface and write zone based policy with any destination addresses to allow ATM destinations. ... View more

@LupingThere seems to be mismatch in the DN name you have configured under IKE gateway and the certificate present under certificate profile. Also verify IKE version configuration at both ends. ... View more