About jburugupalli

Hello Jambulo, Candidate configuration will overwrite the previously candidate configuration. It is not possible to go to a previously saved candidate version. Named configuration Snapshot will Save the candidate configuration to a file by giving it a name. Every time save named configuration snapshot is clicked, it will create a new instance of the file and can be exported as a backup for later use using Export named configuration snapshot. Device State - If the device has shared policies pushed from the Panorama, these policies will not be included on the device running configuration file and will be included in the 'device state' file. (Panorama)Scheduled Config Export -  you can schedule the export of running configurations from all managed devices in addition to its own running configurations. Please refer below link to configure schedule configuration export How to Schedule Configuration Export on Panorama? Panorama and devices config bundle—This option is used to manually generate and export the latest version of the configuration backup of Panorama and that of each managed device. (exports configurations with password hashes) Regards, Jahnavi.. ... View more

Hello Serigo, Not all zones on the firewall are available in the drop down list. Zone names have to be manually entered the first time. When creating new zones on a firewall, simply add the same zone to Panorama. Once the zones have been created in Panorama, they will become available for policy rules. Please also refer the below link: New Zone Not Visible in Panorama Regards, Jahnavi. ... View more

Hello Peri, This feature is not yet implemented on PAN OS.  Please refer thread  Re: QoS on Tagged VLAN Sub-interface Subject: Sub-interface based QoS on PA-5000 Priority: High FR ID: 1768 Subject: QoS Bandwidth Policing Priority: High FR ID: 2475 Please send your request to your SE as they have more insight on it and can vote on behalf of you. Regards, Jahnavi. ... View more

Hello Erwin, The user-id agent is independent of the PAN-OS version , with the only restriction of you at least running User-ID 3.1.0. However we recommend that you run latest User-ID version on your environment for now. If you see authentication failure with reason user is not in allow list - can you try using a domain name in the LDAP server profile, use a netbios domain name under domain field of LDAP server profile. - If group is in question please run CLI command to show that the users are part of the group: > show user group name <name> If the users are part of the group read and group is referenced in the drop down for the Authentication Profile, the user fails authentication can please leave allow list to " all" and test authentication again. Regards, Jahnavi. ... View more

Hello Tiwara, We will see this log message " websrvr: exiting because service missed too many heartbeats" will show up if the masterd process missed a certain number of heart beats from websrvr and assumes the process to be dead and will restart the process and not the deviceto recover, this is seen if device is busy and missed processing heartbeats. Please create support case with tech support file attached to so that we can further analyze the issue. Regards, Jahnavi. ... View more

Hello jwolach, The config that is saved and exported from the device will not include the panorama pushed config. You will need to export the merged config from the tech support file under  opt\pancfg\mgmt\saved-configs or either from the cli with below command > scp export configuration from .merged-running-config.xml to <server> Regards, Jahnavi. ... View more

Hello gafrol, Contents 429 has been pulled, it is not available for download anymore. Thanks. ... View more

Hello gafrol, If you have an issue with 429 not being able to see the new tid, can you log out of the device then log back in again and see if you see it. Regards, Jahnavi. ... View more

Hello Art, Yes, Panorama can manage devices running supported PAN-OS versions of the same or a lower release. It cannot manage firewalls running greater PAN-OS versions than itself (eg. 5.1.x Panorama cannot manage 6.0 boxes). Regards, Jahnavi. ... View more

Hello. One user-id agent can talk multiple firewalls simultaneously. Follow below steps to make firewall communicate with User-ID agent: Log into the Palo Alto Networks firewall and go to Device > User Identification Configure Name, Host (IP address) and Port of the User-ID Agent. Enable user identification on each zone to be monitored.  On the Network > Zone page, edit the appropriate zones. In the bottom left corner of the Zone properties page, check the box for Enable user identification. Commit the changes. For more information please refer the below link: Architecting User Identification Deployments Regards, Jahnavi. ... View more

Hello Infotech, Please refer the following link for detailed explanation about incomplete in the application field: Incomplete, Insufficient data and Not-applicable in the application field Regards, Jahnavi ... View more

Hi, User Identification Timeout on agent contacts the AD server for group membership information, 60 minutes default. Regards, Jahnavi ... View more

Hello Zewwy, Please refer the below link to upgrade the User-id agent to latest version How to Upgrade User-ID Agent? Thanks, Jahnavi ... View more

Hello apackard, Getting 'No Update Information Available' when looking for the latest software packages    -  When you go to tab software under tab panorama you get error "'No Update Information Available' can you please click on Check Now link at the bottom of the Software page. When it sometimes does work, when trying to download latest (6.0.1) image we get an authentication\integrity error on the package.       - this error might occur during software upgrades. This error does not mean there was a problem downloading the new image, but instead it indicates that there is something wrong with the current PAN-OS image. Can you please try to re-install the current PAN-OS software then attempt the upgrade again. Please refer the following link for more information about the PAN firewalls not forwarding logs to panorama Palo Alto Networks Firewall not Forwarding Logs to Panorama (VM and M-100) Regards, Jahnavi ... View more

Hello Lachen, You can refer the following document to push the firewall certificate using GPO. Pushing Firewall Certificate using GPO Regards, Jahnavi. ... View more

Hello jwolach, The devices listed in the managed devices are ordered by HA pair and serial numbers. The device with lower serial number will always first as HA master device and the second device in HA pair with high serial number will be listed " HA peer device". Note:Master and peer device designation has no correlation with which device is Active or Passive in an HA Pair. Regards, Jahnavi. ... View more

Hello Lachen, tech note indicates 500 series devices is not able to support policing but does perform traffic shaping. Policing is performed to avoid unintentional starvation of the QoS priority queues. All platforms support shaping, which is at the egress interface only. In PA-200/500 and PA-2000 Series devices, Shaping is performed in software only. However, in PA-4000/5000 Series devices, Shaping is performed in hardware. Qos rules matches exactly what is configured in that rule and apply Qos profile matching the rule exactly like security policies. If we you apply Qos policy for set of users,Qos profile and Qos class matching the rule will be applied only for that users. And if you want you also can enable Qos policy only at certain time range by using the schedule feature. Regards, Jahnavi. ... View more

Hello Lahcen, Configuring Qos on V-wire is nothing different than configuring it on other type of interfaces . Doc about Qos in PAN. https://live.paloaltonetworks.com/docs/DOC-3439 Qos rules matches exactly what is configured in that rule and apply Qos profile matching the rule exactly like security policies. If we you apply Qos policy for set of users,Qos profile and Qos class matching the rule will be applied only for that users. And if you want you also can enable Qos policy only at certain time range by using the schedule feature. Regards, Jahnavi. ... View more

Hello Kalus, We see the above error message if the "multi virtual system capability" under tab > device> setup > management > general settings  is not enabled on the passive device.  You need same set of licenses on both devices in HA pair , because when the devices switches over then you will not be able to get the same functionality on both of them. Regards, Jahnavi ... View more

Hello Amber, Only one log forwarding profile can be assigned to a security policy at any given point of time, but different security policies can have different log forwarding profile assigned. So to get email alerts for vulnerability, AV and Spyware for any severity , you can create email profile and attach email profile to log type " Threat"  as suggested by Steven Puluka Please let us know if you have any questions. Regards, Jahnavi. ... View more