About egarantiva

Hello    I have the same Issue, the Windows User-id  Agent 9.1-2 shows some mapped users in format "domain\user" and some in "user@emaildomain"  , and even shows localmachine users mapped too. Is there a way to force the user format normalization like previous to 8.1 User-id versions do ?  ... View more

Hi Rich    You're right, try to add the ZTP models on Panorama using a traditional way results in a weird "Disconnected" state. Try to remove the ZTP template by disabling the panorama templates and policies(as it says  PAN-160870 workaround) causes an Autommit failure after a PA reboot due to "network is missing interface" and some other issues and you will need to do the factory reset to correct that. I figured out the only way to deploy those ZTP models was using the Panorama ZTP Plugin to register and add the PA as a managed device using DHCP via WAN (on eth1/1) and then disable the ztp state (request disable ztp) to be able to reach the PA from mgmt port (being careful to change locally on the PA the "Panorama service route" to mgmt port in the proper moment). Next, from the Panorama and locally on the PA, you should remove the ZTP template and DG from Panorama progressively until you get free the PA of that ZTP configuration. ... View more

Hello Nikolay   We're still waiting for a fix in the next PAN-OS 9.1 release (9.1.9). Apparently, the WebUI Mgmt "Unknown" Issue is related to bug  PAN-156264. This behavior doesn't permit add PAs as a managed devices on Panorama in a traditional way.  We tried the PAN-160870 Workaround to disable ZTP Pre-configuration but it didn't work after reboot the PAs. Using the ZTP plugin to deploy PAs works, but still keeping requiring the ZTP DG and Template configuration to avoid the PAN-160870 issue after finishing the deployment and it does not make much sense to me. As soon as I have news I'll let you know. ... View more

Hello Nikolay, thanks for your all advices , we're going to test those suggestions, until we can check with TAC in a Live Meeting. I'll let you know when we have more clues about the issue with these ZTP models. ... View more

Hi Nikolay   Thanks for your reply. Please let me know if you have seen this behavior of "Unknown Mgmt IP info on GUI" when you're deploying ZTP models in a traditional way. If I reset to factory default a ZTP Model, it comes back to the original ZTP state according to the notes in the procedure "Disable the ZTP state machine on the firewall" and I think the issue is related to this ZTP pre-configured template.   https://docs.paloaltonetworks.com/panorama/9-1/panorama-admin/manage-firewalls/set-up-zero-touch-provisioning/use-the-cli-for-ztp-tasks.html ... View more

Hello Guys I want to know something about it ... what would happen with the HA Pair Licenses / Subscriptions attached to the Nodes that will work as a Standalone? later when I need to renew the licenses what I supposed to do? Please let me know your viewpoint. Regards ... View more