About Sec101

I see that snmp queries can be used to discover devices for IOT using xsoar engines.  I also see that it uses cdp lldp and gathers arp and mac data. https://docs.paloaltonetworks.com/iot/iot-security-integration/network-management/integrate-iot-security-with-network-switches-for-snmp-discovery Specifically in the documentation: The XSOAR engine also queries the entry switch for the IP addresses of neighboring switches on the network. It collects device information from them next and also gets a list of their neighboring switches as well. XSOAR continues collecting device information and learning about other switches until it has queried them all. What I don't understand is what happens when this engine hits a L3 boundary.  Does the discovery continue past/through an MPLS network, or is it simple snmp queries, and will it fail past a routed MPLS connection, not discovering other networks/routers? ... View more

Why is it that on some devices I am able to click and create policy (highlighted blue), but others like the Lenovo computer, or Dell Computer profiles I am unable to click and create a policy for them from the profiles page?  Seems to be related to devices that fall into  Device Type:"Traditional IT"  or device types that are blank.   Maybe a better question is - what device profiles do NOT allow you to create a policy set in IOT? Is this related/correlated to confidence score, or is there something else I am missing here?     ... View more

On devices like the 7000 and 5400 series, is there something special needed to see QOS stats graph locally on the firewall?   Local logging is turned on, but the graph does not appear, just get the " No statistics available for this interface".   Outside of local logging, any other config that is needed to get this to appear?   ... View more

Has anyone noticed issues with 10.1 and trying to register ip to tags on mult-vsys firewalls from/through panorama?    We've been registering ip to tag through panorama for a while with success.  Everything appears to have worked when using panorama (10.1) to register ip to tag on firewalls (9.1), but ever since keeping panorama on 10.1  and upgrading the local firewalls to 10.1, it now looks like the firewalls only ever want to register ip to tag on vsys1 by default, and no other vsys is getting the ip to tag registration.   Anyone else having this issue/seen this issue? ... View more

Is Global protect without Prisma ever going to get anything related to what ADEM does for prisma?   Would be super nice if some of the features would report back to local FW, or even just hold some information on the client for troubleshooting purposes.   ... View more