About kn

Hi @pranesh01634  The datasheet at the below link will help you. If you need any further details please let us know.   https://www.paloaltonetworks.com/apps/pan/public/downloadResource?pagePath=/content/pan/en_US/resources/datasheets/prisma-sd-wan-instant-on-network-ion-device-specifications   -KN ... View more

Hi @Markus_B  The possibility you explained with the switch will not face the issue because the drive with an HA-active state will continue its functioning. All my inputs are from experience. and HA logic is similar to VRRP here with Prisma-SDWAN.  ... View more

Hi @Markus_B   In-person, I don't think connecting the ION controller2 interfaces back to back is a smart idea. When the active ION is powered off, the backup ION cannot become operational since its HA-control port (controller2) is likewise shut down. You may run a fast test on this behavior to confirm the above assertion. -kn   ... View more

Hi @prodrick  Thank you for clarifying the requirement.  We can modify the same script for the details you need. In the case of ION devices mostly controller interface IPs can b treated as management IP but, but for some device models where the controller interface is not configured, we may need to consider the LAN interface.    Script output contains required parameter.    ... View more

Hi @prodrick  The code at below URL will help you to address your needs.   https://github.com/ktanushree/get-all-interface-info   Thanks    ... View more

Hi @prodrick    Hope the document with the below URL will help you.  https://docs.paloaltonetworks.com/prisma/prisma-sd-wan/prisma-sd-wan-admin/prisma-sd-wan-sites-and-devices/set-up-sites/manage-hub-clusters ... View more

Please help me with a bit more info, if your environment is configured with SD-WAN VPNs (secure fabrics). If yes and you still do not see the data then please reach out to support for further assistance.  ... View more

At bottom of the page at link below you will find the stencils for ION  https://docs.paloaltonetworks.com/prisma/prisma-sd-wan ... View more

Hi @Carracido  Are you observing this issue with a specific software version?  I have tried it with my environment and do not see any issue there.  Please make sure we have to USE THIS SUB-INTERFACE FOR... as INTERNET  ... View more

Hi @mohit.kukreti  Bouncing LAN2 interface will trigger HA fail-over process but as soon as the primary device LAN2 interface goes up/up it will again claim for the HA-Active role.  I recommend unplugging the cable from LAN 2 interface and waiting for the skew time to the secondary device to take an active role. (The skew time is calculated by taking 256 – the router priority / 256) Once the secondary device is HA-Active it will request for DHCP IP to wan router and then start forwarding traffic. It is recommended to use a static IP address on WAN side to minimize the fail over time.  helpful commands... #dump spoke-ha status ===> to check device HA state.  #dump interface status internet1 ===> to check if the device got IP address from DHCP.  #inspect flow brief ==> to see if traffic is working fine.  ... View more

Hi @Metgatz  I will try to describe the possible solutions with some general use cases.    PANOS-SD-WAN  With Panos-SDWAN you can replace most wan facing hardware and a couple of firewalls will cover your needs at almost all locations. All traffic can be inspected for EAST-WEST and NORTH-SOUTH  directions which helps for zero trust.  Creating and managing the SDWAN fabric is a bit complex task, and someone with good knowledge of PAN-OS will be easy to deploy and manage infra.  The major drawback of this option is the analytics and reporting part which are better with Prisma SDWAN. Prisma-SDWAN + Prisma Access Compared to PAN-OS SDWAN Prisma SDWAN is easy to deploy and manage and will leverage your visibility in the network at a much granular level which helps to address network and application issues with minimal turnaround time.  With Prisma SDWAN at branches, you may not get the full fledge firewall but this does support zone base firewall features.  EAST-WEST traffic can be inspected by Prisma SDWAN and NORTH-SOUTH can be addressed by Prisma Access to cover you for all firewall features. If an organization is looking for Zero trust in all aspects then using PAN-OS SDWAN will be a good use case too. But if the organization is looking for SASE with all core SDWAN features I will recommend using the Prisma SDWAN+Prisma access Cloud managed. Hope the above comments help you make a decision if you need more details please let us know or feel free to reach out to salses team for presentations on both solutions.  Thanks  KN   ... View more

Can you please help me with the output for the below commands? # dump overview  # dump interface status all #file tailf log elem-mgr   ... View more

Hi @rushwag  Please check if the site is in disabled/analytics mode. The bypass pair will not work in those modes.  You need the site in control mode to get those bypass pairs working.  ... View more