About bafergel

Yes there is return traffic, however only a handful of packets so it doesn't appear as if much information passed in these connections. The successful SSL connections pass many more bytes and packets. And the incomplete connections only start appearing when those extra URLs are added, and SSL ones start getting blocked. The policies did not change and while in a broken state I did a test policy match and that traffic should have hit our rule... but it just didn't. These particular clients are configured to reach out to a specific URL, the URLs that were added that broke it did not modify or orverlap with this URL. The added URLs were mostly shopping/sports sites. ... View more

Hello @dtran, If you see the traffic being allowed in the firewall, I would recommend going through the steps of this article and see if Palo lists a reason as to why its dropping the connection. These steps have been helpful many times before in my troubleshooting.  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CloNCAS ... View more

It may just simply be a visual bug. If you do "show devicegroups name ?" on Panoramas cli does that show correctly? You could also just restart the management server and see if that addresses the issue, "debug software restart process management-server".  ... View more

Hello @DarylMaurice, assuming I'm understanding your question correctly a setting up QoS would be your best bet. You could set up a QoS profile and set a class to a max of 25% (lets say class 3 for this example). With a QoS profile, any traffic not specified will be class 4. Under Network>QoS, click create and attach to your egress interface. In your case the Egress max would be 4000. Attach the QoS profile you just created to the clear text and/or tunnel interface.    You will also need to create a QoS rule to say what traffic you designate for what class. Under policies>QoS, select create. Say for example you create a rule with a destination of your cloud backup (we'll say 2.2.2.2). And under other settings select the class you want it to apply to (in this example, class 3). You can do this with other traffic you want identified, and again remember anything not specified by a qos rule will default to class 4.    Let me know if this helps! ... View more

My assumption is that if you view the logs in Panorama is would show Panroamas times for logs but I'm not certain on this. In our environment everything is set to the same timezone of Panorama, regardless of what timezone they are in. ... View more

Do you have physical access to the firewall? You should still be able to console in.   I believe this article is referencing your issue. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClLqCAK   In regards to whitelisting for PCI scans, you may be wanting to look at an exclusion for the zone protection profile.    ... View more

Here is the link to the thread and expedition tool.    https://www.paloaltonetworks.com/products/secure-the-network/next-generation-firewall/migration-tool   https://live.paloaltonetworks.com/t5/automation-api-discussions/how-to-quickly-find-and-remove-unused-objects-in-policy/td-p/230055  ... View more

I believe you may be able to use the Expedition tool to achieve what you're looking for. I have only briefly used the tool so someone else may be better at answering this but it looks like there is another thread discussing this.   Here is what  TomYoung said in regards to this:   " Expedition can make changes directly on the firewall.  It has been a while since I have done it, but I believe you add the device under Devices and make the changes under your project > Export > API Output Manager.  You should know the difference between Atomic and SubAtomic changes.   You could also use "show | match <object-name>" in configuration mode (set format) and see where it is used in the configuration.  If the only line is the address object, it is not used.   You could also delete the object.  If it is used, you will get an error right away.  If not, the delete will be accepted in the candidate configuration.  UPDATE:  I saw this on Reddit, and it works.  Select all the objects.  (This may not be quick depending upon the number of objects.)  Select Delete and Yes.  All unused objects are deleted.  All used objects produce an error and are kept.  Use Device > Config Audit to see which objects were deleted.   Once Expedition is setup, that is the quickest and easiest." ... View more