About licenselu

The firewall was (and still is) directly connected to its L3 peers, which I manage as well. I've tried the MTU fix, but it did not help. Reducing the amount of exchanged information (splitting areas and using NSSAs) helped a bit, making the issue less frequent, but it still occurred from time to time. Upgrade to 9.1.8 resulted in the first two consecutive forced failovers without any issue at all. ... View more

Same issue on PAN-OS 9.1.3. please help!!! ... View more

Also, make sure DNS if configured so the firewall can resolve updates.paloaltonetworks.com.     ... View more

Hi @licenselu    This is a known limitation of PaloAlto firewalls. If you do inter-vsys routing then everything is done in software. The only way to get the full performance of the box is if you "think outside of the box": the traffic needs to go out of the firewall and come back over a switch/router to another interface of the next vsys. ... View more

Hi all,   Using (source/member contains '192.168.1.0') or (source/member eq '192.168.1.0') only returns policies where the name (NOT the ip address) contains (or equal) to 192.168.1.x. If the object name is for example 'server' then the rules associated to this oject are not displayed...   Regards,   HA ... View more

My rule of thumb is that I don't make any changes to my firewalls outside of Panorama. I have never had Panorama down outside of Panorama upgrades, so it hasn't been an issue. If I did make changes locally, I would just manually recreate on Panorama. Since you only have 1 cluster, it seems unlikely that Panorama would be down and you needed to make many changes locally. I have found that the import process back into Panorama can be a challenge, especially if there is existing configuration. I believe that duplicate items can get created. ... View more

@licenselu, What I meant was that when companies attempt to setup the configuration with a single VSYS to get everything functional with minimal changes with the intent to eventually switch to a multi-VSYS setup, they hardly ever actually make it to a multi-VSYS deployment. Once you have a working system in production moving to a multi-VSYS deployment is the steps to move the configuration over to a multi-VSYS and update the routing and security policies appropriately is a lot of work, with a large possibility of downtime as you work through any issues that may arise.    ... View more

They're so new that I bet only a handful of customers have them. I would just take a look at their spec sheets and compare them with the other midsize business models they have (3000s).     https://www.paloaltonetworks.com/products/secure-the-network/next-generation-firewall/pa-800-series     I'd love to get my hands on one but we all know they'd never send me one 😞   - Peter ... View more

Thansk steve ! ... View more

If you have on-demand connect method with GlobalProtect and have encountered issues with the app not being resillient , for e.g.    1. Does not detect VPN disconnects fast enough and continue to think its connected  2. Drops connection when there is temproray network glitches    then please unicast me or reach out to your palo alto networks account team or support so that we can better understand the concerns/requirements to evaluate future enhancements.   ... View more

Hi,   You can use the debug tool in GP to get more information.   Also check the following article for more information on troubleshooting GP :   Troubleshooting Global Protect   Hope it helps, -Kim.     ... View more

I have been using Firemon . I believe you must evaluate Firemon once . ... View more

I have the 2GB version. ... View more

 http://www.rfc-base.org/rfc-7413.html  however I fail to see the importance of allowing SYN with data or not.    2. Data in SYN Standard TCP already allows data to be carried in SYN packets ([RFC793], Section 3.4) but forbids the receiver from delivering it to the application until the 3WHS is completed. This is because TCP's initial handshake serves to capture old or duplicate SYNs. ... View more