About cstancill

I believe expedition just takes a config snapshot (the Panorama xml config file rather than a tarball). ... View more

Panorama will not ingest tags from AWS directly. What you can do is create the AWS tags in Panorama manually. Then the firewall will apply the tag to IP mapping when it inforces policy based on those same tag values it learns from AWS. ... View more

Jared is absolutely correct regarding using decryption to enable inspection. To address the performance concern: whether or not decryption has an appreciable effect on your performance depends entirely on *how much* you are decrypting. Each platform has specific upper limits in terms of the maximum number of concurrent decrypted sessions. The additional overhead caused by decryption will depend on this volume. You can limit the scope of decrypted traffic using different criteria (e.g. URL category). This approach will let you inspect things that need to be, like youtube, facebook, etc. while not wasting resources on sessions that probably don't need to be (e.g. online banking, healthcare, etc). ... View more

Is there an issue creating a second set of tunnels? Unless you will have the same public addressing at your DR site, using the same configuration won't help (as the other end of the tunnel won't be configured for the DR IP address). Additionally, having a second set of tunnels that are already up will reduce your recovery time. ... View more

Have you tried downloading the license from the support portal on a system that has internet access (e.g. a laptop) and uploading it to the firewall from there? ... View more