This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Get Started
- News & Events
- Collaboration
- Education Services
- Technologies
- Next-Generation Firewall
- GlobalProtect
- Threat Prevention Services
- Endpoint Protection
- SSL Decryption
- App-ID
- Content-ID
- User-ID
- 5G
- IoT Security
- Cloud Identity Engine
- Panorama
- AIOps for NGFW
Network Security
- Prisma Access
- Prisma Cloud
- Prisma SD-WAN
- Cloud NGFW for AWS
- CN-Series
- VM-Series:
- Private Cloud
- OCI
- Alibaba
- AWS
- GCP
- Azure
Cloud Security
- Cortex XDR
- Cortex XSOAR
- Cortex Data Lake
- Cortex Xpanse
Security Operations
- Resources
About Deepak25
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- LIVEcommunity
- About Deepak25
Online
58Posts
4Likes
0Solutions
Jun 23, 2022Last Visited
User
Activity
User
Profile
Latest posts by Deepak25
| Subject | Views | Posted |
|---|---|---|
| 77 | 06-16-2022 10:10 AM | |
| 414 | 03-16-2022 05:47 AM | |
| 525 | 03-10-2022 03:17 PM | |
| 918 | 01-10-2022 09:05 AM | |
| 371 | 01-09-2022 10:26 AM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 12-19-2021 06:15 AM | |
| 1 Like | 07-18-2021 06:18 PM | |
| 1 Like | 12-19-2021 06:13 AM | |
| 1 Like | 01-03-2022 05:25 AM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 1 Like | |||
| 1 Like | |||
| 1 Like | |||
| 2 Likes | |||
| 1 Like |
User Badges
Community Statistics
| Member Since | 06-01-2021 12:11 AM |
| Date Last Visited | 06-23-2022 01:40 AM |
| Posts | 58 |
| Total Likes Received | 4 |
06-16-2022
10:10 AM
We want to upgrade panorama from 10.0 to 10.1. We have HA panorama M200 , in Collector group we have three LCs (Primary Panorama Local LC , Secondary Panorama Local LC , Dedicated LC )
Below upgrade consideration point applicable for above setup ?
... View more
03-16-2022
05:47 AM
Hi @PavelK ,
Thanks for help.
I have go through shared KB's but still have some queries regarding log redistribution when Collector group having three log collectors.
1. In current setup for location A firewalls (2 HA pair) - primary LC is location A panorama LC and secondary LC is location B panorama LC in log forwarding preference. Same for location B firewalls (2 HA pair) - primary LC is location B panorama LC and secondary LC is location A panorama LC in log forwarding preference. - What is the best option to add third LC in log forwarding preference list in order to utilize its space for logging. Do we add new LC as a tertiary in existing log forwarding preference lists or we should create new log forwarding preference list for some firewalls from the list and keep new LC as a primary and others as secondary , tertiary.
2. Currently we have configured Location A Panorama as primary and location B panorama as secondary in all locations firewall devices. Does this setting is effective only in case of firewall management when Panorama is in HA. Because as we are adding new LC in logger mode in existing LC group of Panorama where built in LC's also added , how firewalls will forward the log to this third LC if we keep this as a primary in log forwarding preference list for some firewall. As we are not mentioning third LC ip in panorama setting of firewalls.
3. In log forwarding preference , if primary LC is full does the log store to secondary LC. and if secondary LC is full does it store to tertiary LC.
4. Currently in both LC's in collector group is full and logs are purging after every five days. So after adding third LC in collector group after redistribution, disk quota of LC1 and LC2 will reduce ? will it lower down from 100 % utilization.
... View more
03-10-2022
03:17 PM
In current setup we have Panorama M200 in HA pair and managing location A and location B firewall centrally. We have enabled local log collector on both Panorama and added in same collector group with redundancy enabled.
Also log forwarding preference is enabled , in which location A firewalls sending logs to Primary-Active Panorama and location B firewalls sending logs to Secondary-Passive Panorama. As redundancy is enabled in LC group , both Panorama storing copy of each other.
For eg.
With redundancy enabled we are able to store only 6 Months of logs in Panorama. We want to store the logs for 1 year hence purchased one more M200 device and want to add in current setup for logging.
Have below queries :
1. How I can add new Panorama in existing Panorama HA pair setup ?
2. How I can add in collector group ?
3. Adding in new Panorama in existing collector group will increase the sizing or it will be same due to redundancy.
4. How firewall will forward the logs to Third panorama. How logs copy will create.
5. What is the best possible way to add new Panorama for logging and increase log retention.
... View more
01-10-2022
09:05 AM
Running the command on firewall resolved the issue. I can see increased timeout value on firewall and radius authentication going to secondary radius server when primary radius server is unreachable.
... View more
01-09-2022
10:26 AM
We have enabled internal host detection in GP portal with "enforce users to connect GP" option to yes. There is no internal portal and internal gateway configured. When user walk into office GP connecting as a internal. We have set our DNS server ip in internal host detection. I was thinking about failover perspective, what if this DNS server is down due to disaster/DR drill activity , other DNS server will be there in user's LAN adapter to provide reverse DNS response for specified hostname. But connectivity to specified hostname(in our case DNS server) is require for successful internal host detection ? or it just success only with reverse DNS lookup.
... View more
01-07-2022
01:38 PM
@PavelKI have set GP auth timeout via panorama by running command : set template <name of the template> config deviceconfig setting global-protect timeout <time out value> But when I check #show deviceconfig setting global-protect in firewall CLI , changed value is not showing. Same command if try in Panorama , I can see the changed value. Is it expected ?
... View more
01-06-2022
12:38 AM
Overriding template for small change is not looks proper. What is the command to increase timeout via panorama?
... View more
01-03-2022
05:25 AM
1 Kudo
We are managing the firewall through Panorama. We want to increase the global protect timeout as mentioned in below article. https://knowledgebase.paloaltonetworks.com/kCSArticleDetail?id=kA10g000000PNma Can we make the changes directly through local firewall CLI ?
... View more
01-01-2022
05:07 AM
Does it support Vmotion and DRS ?
Backup required ? If yes, Snapshot backup supported. Is it recommended ?
... View more
12-19-2021
06:15 AM
1 Kudo
What is the meaning of GP app setting "Allow GlobalProtect UI to Persist for User Input" , for what purpose this option we can use ?
... View more
12-19-2021
06:13 AM
1 Kudo
What is the meaning of GP app setting "Have User Accept Terms Of Use before Creating Tunnel" , for which purpose this option is useful ?
... View more
12-19-2021
03:59 AM
We have created internal gateway and tunnel is not configured in same. Below setting is applicable for machines connected to internal gateway ? Login lifetime , inactivity logout and disconnect on idle setting is applicable for them ? also authentication cookie usage restriction option applicable to them ? Reason behind asking this query is , We have common portal for external and internal gateway , which is configured on public ip. If machine connected to external gw , agent will get this config when its outside. When users connects this machine to LAN network and internal gw connected. Config received from external gw will be stored in GP agent. So internal network login lifetime , disconnect on idle and inactivity logout option should not be active.
... View more
12-01-2021
01:34 AM
We want to enforce users to connect GP when they are outside of the network. But when they use their same machine in internet network, this option should get disabled. Can I solve this problem using internal host detection (internal GP gateway) ? If yes , there should not be ip-user-mapping by GP in internal network .
... View more
11-28-2021
04:03 AM
The endpoint having GP client version 5.2.8, is having an issue to connect to Secondary DNS Server for SIP traffic only. The issue is occurring on 5.2.8 when the primary DNS is not reachable. • WFH users connected to VPN gateways, were having primary DNS DC1 and secondary DNS DC2 in VPN setting. • Due to Planned activity Primary DNS DC1 server was shut down. • DNS resolution traffic was successfully working for all the applications (internal and internet ) except genesys softphone SIP traffic by DC2. • To mitigate the impact, Primary server DC1 started and issue got resolved. • While doing detailed analysis it has been observed that the endpoint having GP client version 5.2.8, is having an issue to connect to Secondary DNS DC2 Server for SIP traffic only. • The issue is occurring on 5.2.8 when the primary DNS is not reachable. Same scenario works fine on 5.1.8 • Also when we change the sequence of DNS servers in GP setting i.e. DC2 as primary which is active and DC1 as secondary which is shutdown , then we are able to login the application and can see SIP session on firewall from client machine. Means no issue in DC2 Anyone faced this kind of issue in 5.2.8 ?
... View more
- Tags:
- dns
- globalprotect
09-27-2021
02:34 AM
@PavelK Thanks for reply. So to achieve our requirement public ipv6 ip is needed and NAT64 nat do not require. Is it correct ? If we are using reverse proxy for ipv6 to ipv4 , A. can we enable ipv6 on same DMZ interface? B. ipv6 ip of proxy server will be as a destination nat private ip ..right ? How we can configure 6to4 tunnel in palo alto ?
... View more
Contact Me
| Online Status |
Online
|
| Date Last Visited |
06-23-2022
01:40 AM
|
Latest Tags
No tags yet
LEGAL NOTICES
Copyright 2007 - 2022 - Palo Alto Networks