About Deepak25

We want to disable redundancy in existing collector group configuration due to less available space for logging one year logs.   In our setup we have M200 in HA  and configured local log collector in both Panorama. Configured collector group and added both local log collector in same collector group. Enabled redundancy to store copy of same logs in both collector. Now both collectors utilized upto 60% and showing last 4 month oldest logs. In order to save the logs for one year current redundancy setup is not useful , hence we can to disable redundancy option in same collector group.   Is there any issue or loss of logs if we unchecked redundancy option in collector group. Also want to know if there is any loss of logs after configuring log forwarding preference list in same collector group( we have Panorama HA pair and geographically at different location , hence want to configure log forwarding preference list in same collector group to send logs to nearest collector and if it failed firewalls will send logs to secondary collector) ... View more

we have configured Panorama M200 in HA , configured managed collector with local log collector , configured collector group and added local log collector of both panorama,  redundancy is enabled in collector group (log forwarding preference is not configured.   Above configuration we have done to store same logs on both local log collector and enable redundancy So if complete Pri M200 box failed , we will have same logs in Sec M200 local log collector. But as per configuration logging is not happening properly on secondary panorama , there is a difference in system dis-space utilization Also we sec panorama log collector not receiving any log ( as per our requirement and redundancy conifg secondaryM200 also should store the logs)   is there any configuration issue , or the output in sec m200 is normal ? how we can check same logs are store or not in sec M200 ?   We are able to see same logs in both M200 webgui , as per my understanding its because of collector group config . ... View more

we have changed service route of user-id and ldap service from mgmt to dataplane interface of firewall. in windows based user-id agent earlier mgmt ip was showing connected,but after changing service route to dataplane interface , dataplane interface not showing in windows based user-id agent connected list. do we require to change serivce route of dns service from mgmt to dataplane interface ?     ... View more

We have upgraded only Panorama to panos 10.5 , after that we are getting below system alert from all firewalls : SYSTEM ALERT : high : No valid device certificate found   What is the meaning of this alert ? We haven't enabled the features mentioned in below link , still we are getting this alert for all managed devices  https://docs.paloaltonetworks.com/panorama/10-0/panorama-admin/manage-firewalls/install-the-device-certificate-for-managed-firewalls.html   Resolution is mentioned in below link , but where we can find actual setting done on Panorama or firewall causing this alerts ? https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HAayCAG&lang=en_US%E2%80%A9 ... View more

We have received below email alert from Secondary Panorama , what's the meaning of this critical severity event? actionflags: 0x0 type: SYSTEM subtype: ha config_ver: 0 time_generated: 2021/06/04 10:22:37 high_res_timestamp: 2021-06-04T10:22:37.000+05:30 dg_hier_level_1: 0 dg_hier_level_2: 0 dg_hier_level_3: 0 dg_hier_level_4: 0 vsys_name: device_name: PANORAMA-SECONDARY vsys_id: 0 vsys: eventid: state-override object: fmt: 0 id: 0 module: general severity: critical opaque: HA peer determined to be Active through managed devices; staying in Passive state dg_id: 0 tpl_id: 0     ... View more

We have received below email alert from Panorama , what is the meaning of this high severity system logs ? actionflags: 0x0 type: SYSTEM subtype: resctrl config_ver: 0 time_generated: 2021/06/04 08:41:01 high_res_timestamp: 2021-06-04T08:41:01.000+05:30 dg_hier_level_1: 0 dg_hier_level_2: 0 dg_hier_level_3: 0 dg_hier_level_4: 0 vsys_name: device_name: Panorama vsys_id: 0 vsys: eventid: mem-limit-exceeded object: fmt: 0 id: 0 module: general severity: high opaque: Memory lmt exceeds. cgroup_name non-critical memsw_limit_in_bytes 67868033024 memsw_usage_in_bytes 64475250688 dg_id: 0 tpl_id: 0 ... View more