This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About sellington
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About sellington
02-25-2022
9Posts
3Likes
1Solution
Feb 25, 2022Last Visited
User
Activity
User
Profile
Latest posts by sellington
| Subject | Views | Posted |
|---|---|---|
| 4992 | 09-03-2021 10:22 AM | |
| 1413 | 08-30-2021 03:30 PM | |
| 1253 | 08-26-2021 03:19 PM | |
| 1298 | 08-25-2021 01:13 PM | |
| 1506 | 09-16-2020 12:25 PM | |
| 3300 | 09-16-2020 09:37 AM | |
| 4479 | 09-15-2020 08:34 AM | |
| 10629 | 09-04-2020 12:59 PM | |
| 2459 | 08-17-2020 12:27 PM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 09-15-2020 08:34 AM | |
| 1 Like | 09-03-2021 10:22 AM | |
| 1 Like | 08-17-2020 12:27 PM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 1 Like | |||
| 1 Like | |||
| 1 Like | |||
| 1 Like |
User Badges
Community Statistics
| Member Since | 06-15-2020 12:48 PM |
| Date Last Visited | 02-25-2022 04:48 PM |
| Posts | 9 |
| Total Likes Received | 3 |
09-03-2021
10:22 AM
1 Kudo
Hey Ce1028, we have our 3250's on the edge configured with one of the ethernet ports for HA2 instead of the HSCI ports and have not had issues during our failovers. I am not sure if there are any cons to this setup that someone else can speak to, besides losing one of our available ethernet ports, but we have had no issues.
... View more
08-30-2021
03:30 PM
Hello, How is the "Last Hit" metric for a security policy on the firewall generated? Would the timestamp be based on the session start time or the received time of the log? Intuitively I would think the former, but I am starting to think its the latter. Does anyone definitively how this works? Thanks
... View more
08-26-2021
03:19 PM
Looks like I am no longer seeing new sessions initiated with that source user. I am guessing what I was observing was user-id mappings made before I excluded the service account that had not timed out yet.
... View more
08-25-2021
01:13 PM
Hello, We leverage a deployment software at our organization and when a computer is having software deployed or is being scanned for inventory by this software a service account does a network logon to create a temp service to run the process. This process generates a logon event on our domain controllers and maps the IP of the device being scanned/deployed to the the service account on the firewall. This has created some issues with security policies on our firewall as we leverage user-id for most policies. The fix for this seems to be to add the service account to the ignore user list in the user-id configuration and we have successfully done this config on one HA pair of firewalls, however we went to do the same on another pair of firewalls and I continue to see sessions established with the service account as the source user. I have the account added to the list in the same format it is displayed on the traffic logs "domain\user", this is also how we have it successfully setup on the other pair of firewalls. Any ideas on what may be causing the service account to continue to show up on this pair of firewalls?
... View more
09-16-2020
12:25 PM
Hello all, currently we use a Panorama VM running PanOS 9.0.5 in Legacy mode (did not even know that was possible) to manage a couple of HA pairs of firewalls. Unfortunately we are unable to edit the resources of that VM in our Hypervisor, likely due to how it was originally provisioned, so we cannot go the route of adding the needed resources for panorama mode and upgrading our existing VM. We have spun up a completely fresh new Panorama VM using PanOS 9.1.2 in Panorama mode that we would like to migrate to and was looking for some guidance on how we could accomplish this. Are we able to export the config snapshot from the existing panorama, import that config into the new panorama and upgrade to Panorama mode at the same time? If the above is possible, after we transfer the license from the current production Panorama VM to our new Panorama VM will we still be able to view historic logs on the old VM sans license? I have a ticket in with PA support for guidance, but was looking for the communities thoughts as well. Thanks,
... View more
09-16-2020
09:37 AM
Hello, we have an interesting setup, we currently have Panorama in legacy mode at version 9.0.4 (didn't even know it was possible to be in legacy mode on that release) managing a couple of HA pairs of firewalls. We would like to move our config to a Panorama VM in Panorama mode at version 9.1.2 and was looking for some guidance. For some reason, I am guessing how the VM was originally provisioned, we have no way of editing the resources on our existing Panorama VM, so we cannot upgrade our existing Panorama deployment, but instead need to migrate it to a newly provisioned fresh Panorama VM that we spun up (9.1.2 running in Panorama mode). Does anyone have any guidance on how to migrate this config? Can we export the config snapshot -> import on the new VM -> and then convert to legacy mode? If this is possible will this lose our log settings in Panorama? How do we handle this from the licensing perspective? Once we are on the new VM and have transferred the license, can we still view historical logs as needed on the old Panorama VM? I have a ticket open with support for guidance as well, but was looking to see what the communities thoughts were.
... View more
09-15-2020
08:34 AM
1 Kudo
Hello, Recently went through this same upgrade, I could not find a document catered specifically for a migration between these two particular devices, but the basics should mostly be the same as moving between other PA hardware platforms. I used this guide for putting together my basic plan. https://docs.paloaltonetworks.com/content/dam/techdocs/en_US/pdf/hardware/migration/firewall-migration-guide.pdf A couple of quick notes, if you run HA, the port configs vary slightly, the 3250's do not have a dedicated copper HA2 port but instead move towards the HSCI port for HA2. Additionally, if you follow the advice of ensuring they are on the exact same panOS release prior to moving over the config, make sure its a preferred release 🙂 I made the mistake of downgrading my 3250's to a panOS release matching my 3050's prior to the switch over and got hit by this bug in the next release, it was a rough day.
... View more
09-04-2020
12:59 PM
We are currently looking at updating our global protect client and would like to get some guidance on what version we should be updating to, ideally a client that may support MacOS Big Sur when it is formally released. With the global protect client is the latest and greatest considered stable for production or is there a preferred release? We are currently running an HA pair of 3250's on the 8.1.15-h3 release and our global protect client is currently 5.0.5. Thanks
... View more
08-17-2020
12:27 PM
1 Kudo
We have recently gone through a firewall hardware upgrade, and the device that was replaced was our old "Master" device in Panorama. I would like to make the new device our "Master" device, but I am intimidated by the call-out "When you change the Master Device or set it to None, Panorama loses all the user and group information received from that firewall." We have a fair amount of user and group based security policies on our remote firewalls managed through Panorama, if we change out the master device will it literally remove our source user and groups from these policies?
... View more
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks