Hello Jambulo, Candidate configuration will overwrite the previously candidate configuration. It is not possible to go to a previously saved candidate version. Named configuration Snapshot will Save the candidate configuration to a file by giving it a name. Every time save named configuration snapshot is clicked, it will create a new instance of the file and can be exported as a backup for later use using Export named configuration snapshot. Device State - If the device has shared policies pushed from the Panorama, these policies will not be included on the device running configuration file and will be included in the 'device state' file. (Panorama)Scheduled Config Export -  you can schedule the export of running configurations from all managed devices in addition to its own running configurations. Please refer below link to configure schedule configuration export How to Schedule Configuration Export on Panorama? Panorama and devices config bundle—This option is used to manually generate and export the latest version of the configuration backup of Panorama and that of each managed device. (exports configurations with password hashes) Regards, Jahnavi.. ... View more

Hello Serigo, Not all zones on the firewall are available in the drop down list. Zone names have to be manually entered the first time. When creating new zones on a firewall, simply add the same zone to Panorama. Once the zones have been created in Panorama, they will become available for policy rules. Please also refer the below link: New Zone Not Visible in Panorama Regards, Jahnavi. ... View more

Hello Peri, This feature is not yet implemented on PAN OS.  Please refer thread  Re: QoS on Tagged VLAN Sub-interface Subject: Sub-interface based QoS on PA-5000 Priority: High FR ID: 1768 Subject: QoS Bandwidth Policing Priority: High FR ID: 2475 Please send your request to your SE as they have more insight on it and can vote on behalf of you. Regards, Jahnavi. ... View more

Hello Erwin, The user-id agent is independent of the PAN-OS version , with the only restriction of you at least running User-ID 3.1.0. However we recommend that you run latest User-ID version on your environment for now. If you see authentication failure with reason user is not in allow list - can you try using a domain name in the LDAP server profile, use a netbios domain name under domain field of LDAP server profile. - If group is in question please run CLI command to show that the users are part of the group: > show user group name <name> If the users are part of the group read and group is referenced in the drop down for the Authentication Profile, the user fails authentication can please leave allow list to " all" and test authentication again. Regards, Jahnavi. ... View more

Hello Tiwara, We will see this log message " websrvr: exiting because service missed too many heartbeats" will show up if the masterd process missed a certain number of heart beats from websrvr and assumes the process to be dead and will restart the process and not the deviceto recover, this is seen if device is busy and missed processing heartbeats. Please create support case with tech support file attached to so that we can further analyze the issue. Regards, Jahnavi. ... View more

Hello jwolach, The config that is saved and exported from the device will not include the panorama pushed config. You will need to export the merged config from the tech support file under  opt\pancfg\mgmt\saved-configs or either from the cli with below command > scp export configuration from .merged-running-config.xml to <server> Regards, Jahnavi. ... View more

Hello gafrol, Contents 429 has been pulled, it is not available for download anymore. Thanks. ... View more

Hello gafrol, If you have an issue with 429 not being able to see the new tid, can you log out of the device then log back in again and see if you see it. Regards, Jahnavi. ... View more

Hello Art, Yes, Panorama can manage devices running supported PAN-OS versions of the same or a lower release. It cannot manage firewalls running greater PAN-OS versions than itself (eg. 5.1.x Panorama cannot manage 6.0 boxes). Regards, Jahnavi. ... View more

Hello. One user-id agent can talk multiple firewalls simultaneously. Follow below steps to make firewall communicate with User-ID agent: Log into the Palo Alto Networks firewall and go to Device > User Identification Configure Name, Host (IP address) and Port of the User-ID Agent. Enable user identification on each zone to be monitored.  On the Network > Zone page, edit the appropriate zones. In the bottom left corner of the Zone properties page, check the box for Enable user identification. Commit the changes. For more information please refer the below link: Architecting User Identification Deployments Regards, Jahnavi. ... View more