About Kandarp_Desai

Hello, We have configured Palo Alto Panorama ( VM series ) as a log collector and have 2TB disk attached which seems to be the minimum required storage. Now we are observing that it's very underutilized and hardly 200GB is being used. We want to save Azure Storage costs, so is there a solution to this, can we reduce the log collector size from the minimum 2TB to something like 500GB ? Or is there any other solutions to save some costs regarding this.  ... View more

Hello All,  I would like to know what is the meaning of the typical events we observe in the IPsec details in the monitor logs.  ikev2-nego-ike-succ ikev2-nego-child-succ ipsec-key-install ikev2-nego-child-start ikev2-nego-ike-dpd-dn ipsec-key-delete ikev2-nego-stale-p2 ikev2-nego-ike-succ ipsec-key-expire     ... View more

Hi,  We have a pair of Panorama devices for managing couple of pairs of Firewalls ( in HA ) all in Azure. We have scheduled the config export which is scheduled everyday to store the config backups of Panorama+Firewalls in a server.  If there were a scenario ( I know its very unlikely on Azure since there are Availabilty Zones configured ) but in the very rare case that both availability zones are down ( which host one firewall each in HA ), then , will the config backups be enough to restore the firewalls. The steps for restoration in this case as follows: 1. We would want the firewalls up and running (post all the backend networking configured in some new region ), for this we would run the ARM templates.  2. To restore the config backups which are stored (and backed up by Azure ) to the newly built firewalls.   However in the above case, we would require Device states of the firewalls and config backups are of no use in this scenario because our policies which are managed by Device Templates can be restored. ( At this point there isnt any newly rebuilt Panoramas in the picture and we would like to build it at the end to get the services up and running first and foremost )   Keeping the scenario in mind, How does one schedule a export of Device states of firewalls because they are very useful in such scenarios. Please let me know any suggestions on this.  ... View more

Hello, Just wanted to confirm my understanding on the different modes of deployment in PA. Virtual Wire is an INLINE mode ( similar like IPS) and TAP mode is a passive monitoring mode. So does that mean if I find an unlocked rack somewhere and I were to remove the ethernet from the switch/firewall in that rack and instead attach it to lets say ethernet1/1 on palo alto in a virtual wire mode, then connect ethernet 1/2 on the palo alto back to the port in the rack, then I can actually be snooping on all the traffic ? And more so not only snooping I can also block some traffic ? In TAP mode, it requires the switchport to be configured to TAP so I think I cannot snoop using TAP mode ?  ... View more

Hello,  As per the question, should we enable these features if we don't use SSL decryption. And also, we want to enable it on our Firewalls as well as our Prisma Access rules.    ... View more