About rbabu0

Hello,   This is quite a complex ask for a forum, but here's what I can tell you.   Firstly, when downgrading from 10.1 to 9.0, you are hitting 2 PAN-OS releases which are end of life and end of support. Those versions are 10.0 and 9.0. If something goes wrong when you reach either of those versions, it may be difficult for Support to help you, and you may simply be asked to factory reset and upgrade back to a supported release.   While I don't know your reasons for doing this, I can't recommend this course of action. If you must downgrade, I would advise getting to 9.1 and no lower.   So about the actual downgrades. 1) I believe you would need to downgrade step by step, 1 release at a time. 10.1 -> 10.0 -> 9.1 -> 9.0. 2) Usually when downgrading, you should select a config which was saved on the version you are downgrading to. It's unlikely your config can be used for the downgrades. If you don't or can't do this, you will very likely see autocommit failures and have to manually delete some things from the config on most downgrades. 3) There are a lot of things to consider when downgrading due to different functionality, especially if you've actually been using 10.1: Upgrade/Downgrade Considerations (paloaltonetworks.com) (10.1 -> 10.0) Upgrade/Downgrade Considerations (paloaltonetworks.com) (10.0 -> 9.1) Upgrade/Downgrade Considerations (paloaltonetworks.com) (9.1 -> 9.0)   Regards, - DM ... View more

Thank you for the post @rbabu0   in nutshell, unless Firewall's related setting (serial number registration, assignment to DG/TS, log collector assignment) has been deleted from Panorama side, all you have to is to make sure that Firewall is configured with Panorama's IP address and all the required ports are enabled between Firewall and Panorama, then all should work again. Below is detailed break down:    In order to re-enable Firewall to be registered and managed by Panorama make sure that below settings are in place on Firewall side: - Navigate to Device > Setup > Management > Panorama Settings > Edit > Panorama Servers. Make sure that Firewall has configured IP address of Panorama (Secondary IP address is used only in the case you have Panorama in HA). - Make sure that Firewall can reach Panorama IP address. By default management interface will be used for registration to Panorama. - If your L3 Team has used the feature: "Disable Panorama Policy and Objects" & "Disable Device and Network Template", then refer to this KB for recovery: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClffCAC   On Panorama side, make sure that below configuration is in place: - Panorama registers Firewall with Firewall's serial number. Since you mentioned that it was previously registered, likely you do not have to do anything unless somebody has completely deleted the Firewall from Panorama. Make sure that Device State under: Panorama > Managed Devices > Summary is reporting status: "Connected". - If you have to onboard Firewall to Panorama from scratch, please refer to this documentation for PAN-OS 9.1: https://docs.paloaltonetworks.com/panorama/9-1/panorama-admin/manage-firewalls/add-a-firewall-as-a-managed-device For PAN-OS 10.1 and higher refer to this document: https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/manage-firewalls/add-a-firewall-as-a-managed-device The only difference between these 2 versions is the step to add authentication key. - Make sure that Firewall is added to Device Group and Template Stack for configuration pushing and log collector group for log collection.   Kind Regards Pavel ... View more

Hi  Pavel,   Sure, will check and tell you. Thanks for your help. ... View more

Hi @rbabu0 ,   So the 1x.6x.x.2 IP address is not 10.6x.x.2?   Thanks,   Tom ... View more

Hi,   You can just change the action here on your default AS profile: Just remember to tick the show all signatures at the bottom left     ... View more