About MHuschenbett

Hi everybody,   I noticed something when migration stand alone firewalls to panorama managed.  In the past, I had multiple customers where I needed to migrate the local firewall configuration to panorama managed and I am allways following the official documentation here: https://docs.paloaltonetworks.com/panorama/10-0/panorama-admin/manage-firewalls/transition-a-firewall-to-panorama-management/migrate-a-firewall-to-panorama-management.html   What I noticed is, that after the config migration to panorama, all secrets in the config were invalid. I noticed it especially on a customer with around 50 ipsec tunnels, where after the migration the log was full with authentication failures. So after reentering all preshared keys in the panorama templates for all of the ipsec tunnels, they all came up. I also noticed it with the ldap configuration. Right after the migration I was not able to login to the firewall with an LDAP user and we saw in the logs of the LDAP server, that there was a wrong password for the configured palo alto LDAP service user. Again, after reentering the password of the LDAP service user on the panorama template, I was able to login again with LDAP.   I have seen this behavior on multiple customers now, with different firewalls (440, 5220, vm-series). They all had in common that they were running a Panorama version 10.0.8+ or 10.1.2+ with firewalls running 10.0.8+ (5220, vm-series) or 10.1.2+ (440).   Has anyone else seen this behavior? Am I missing something in the steps for Panorama migration? I learned now, that when I have to migrate to panorama, that I change all passwords before I push the config back to the devices.   Thank you all, Martin ... View more

Hello everyone! I am planning to create around 200 new subnets on my firewall managed by Panorama template. We plan to restructure our network. I want to do this via the Rest API of Panorama. I was able to create a ae interface via the API, no problem. But I cannot create subinterfaces for this ae interface.   We are running Panorama 10.1.3-h1.    The following is the JSON body I send to the AggregateEthernetInterfaces enpoint restapi/v10.1/Network/AggregateEthernetInterfaces?name=ae2.155&location=template&template=MyTemplate   {      "entry" :   {          "@name" :   "ae2.155" ,          "ip" :   {              "entry" :   [                  {                      "@name" :   "10.10.155.1"                  }              ]          },          "tag" :   "155"      } } I am getting the following response: {      "code" :   3 ,      "message" :   "Invalid Object" ,      "details" :   [          {              "@type" :   "CauseInfo" ,              "causes" :   [                  {                      "code" :   12 ,                      "module" :   "panui_mgmt" ,                      "description" :   "Invalid Object:  ae2.155 'ae2.155' is not a valid reference."                  }              ]          }      ] }   I thought, maybe I am using the wrong API endpoint, so I also tested with the EthernetInterfaces endpoint  /restapi/v10.1/Network/EthernetInterfaces?name=ae2.155&location=template&template=MyTemplate with the following JSON body: {      "entry" :   {          "@name" :   "ae2.155" ,          "ip" :   {              "entry" :   [                  {                      "@name" :   "10.10.12.12"                  }              ]          },          "tag" :   "155"      } } But even with this endpoint I am getting an error: {      "code" :   9 ,      "message" :   "Parent Interface Not Found: Parent interface ae2 does not exist." ,      "details" :   [          {              "@type" :   "CauseInfo" ,              "causes" :   [                  {                      "code" :   200 ,                      "module" :   "panui_restapi" ,                      "description" :   "Parent Interface Not Found: Parent interface ae2 does not exist."                  }              ]          }      ] } But the parent interface ae2 exists, I created it via API...   So my question is: How can I add a subinterface to an aggregate ethernet interface via API?   Thanks in advance, Martin ... View more