About DDmchk

I've met this also and just adopted to it as is. Some automation or manipulation over XML config may increase your perfomance and make you life better. This can be a good point to start learning about it: PAN-OS® and Panorama™API Usage Guide (paloaltonetworks.com) Regarding why it done like it is done, the answer, I guess, that system allow multi-vsys configuration and XML tree of config adopted to support all possible config. ... View more

Hi, Not sure I understand your usage case, but I'm using IP variable  with GP tunnel interface in panorama template and there no issues with this.   ... View more

I've had experience in downgrade of 9.x to 8.1 and it would works for you on empty new firewall (or after factory reset) or in case you have config from same HW for the downgraded PanOS. so in your case my actions would be 1) get PA-820 at same PanOS level (downgrade) on empty FW 2) save and export of PA-820 empty config 2) get copy of running config from PA-500and try to import to new FW. If fails, then edit the config accordingly on WebUI or if you will met the major issues, get offline and edit config for the parts it failing (normally it is interface mismatch),then import updated config and commit. ... View more

Fully aree with Nikolai - I've lived it through - attempts to pritoritize MS Teams by application failed in my case (I've discovered many traffic missing the policy, also we are using UDP for calls, not TCP that can be recognized as ms-teams app - so in my case I've finished with working QoS policy based on MS Teams official endpoint list (https://docs.microsoft.com/en-us/microsoft-365/enterprise/urls-and-ip-address-ranges?view=o365-worldwide#skype-for-business-online-and-microsoft-teams) ... View more