This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About Alin.Scarlat
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About Alin.Scarlat
15Posts
2Likes
4Solutions
Last Visited
User
Activity
User
Profile
Latest posts by Alin.Scarlat
| Subject | Views | Posted |
|---|---|---|
| 137 | 09-18-2023 11:53 PM | |
| 297 | 09-11-2023 09:44 AM | |
| 159 | 09-10-2023 09:41 AM | |
| 459 | 09-10-2023 01:31 AM | |
| 206 | 09-08-2023 10:44 AM | |
| 360 | 09-06-2023 08:38 PM | |
| 246 | 07-17-2023 10:01 PM | |
| 246 | 07-09-2023 08:06 AM | |
| 609 | 06-23-2023 01:06 AM | |
| 1752 | 06-02-2023 09:37 AM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 09-10-2023 09:41 AM | |
| 1 Like | 09-10-2023 01:31 AM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 3 Likes | |||
| 3 Likes |
My LIVEcommunity Articles Contributions
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 0 |
User Badges
Community Statistics
| Member Since | 05-26-2023 10:28 PM |
| Date Last Visited | |
| Posts | 15 |
| Total Likes Received | 2 |
09-18-2023
11:53 PM
Hello @PktBlocker ,
Since Log Collectors and Panoramas are different from a normal firewall, try using the following command to see if this helps:
show system state filter net.s*.eth*.*
This should show the entire ports of said Panorama/Log Collector.
I hope this helps.
... View more
09-11-2023
09:44 AM
Hello @kevinospf,
A template is associated (usually) with a template stack. You then associate the firewalls to the template stack. Eventually when you push the settings it's the template stack settings that have the options inherited from the templates.
If the modified template is not added to any template stack then there's no push available since Panorama will not know where to push that template.
I hope it helps.
... View more
09-10-2023
09:41 AM
1 Kudo
Hello @Nishtha, Indeed it appears that Palo Alto Support team did not update the Day 1 Configuration Template to include version 11.0. It may take a while until they do that. Regarding its credibility, Day 1 configuration provides configuration that is about 50-60% on BPA when it comes to a minimum but secure configuration start. These settings are (but not limited to): Password Complexity settings Session settings Syslog and Email server (added in all global Log Settings categories) Zone protection profiles Custom URL Categories Security profiles (AV, Anti-Spyware, Vulnerability Protection, URL Filtering, File Blocking, Wildfire Analysis) Security Profile Groups Decryption Profile You have to keep in mind that Day 1 Configs are based on IronSkillet full configuration files. More information about IronSkillet can be found here and also a more comprehensive documentation can be found here. One thing that you can also do is to have a blank Palo Alto device (freshly installed) and generate the Day 1 config for it for latest version as of today (10.2.0). Import it locally then load it to snapshot. Before completely committing all the changes do a "Preview Changes" to see exactly what is changing/adding. This will give a big insight into what Day 1 Configuration Template actually does. I hope this helps.
... View more
09-10-2023
01:31 AM
1 Kudo
Hello @kevinospf ,
The push being greyed out it also depending on what type of configuration you have changed. For example if the Loin Banner was the Panorama one, a simple commit will suffice since the changes only affects the Panorama device and no other firewall.
If, for example, you've changed some settings in the Template section (Network/Device) like you have highlighted in the background of your screenshot, there are a couple of possibilities for the Push option to be greyed out:
Depending on the load of Panorama it can take a little bit more time for the commit to finish and for the push button to be active (like @Raido_Rattameister suggested) because maybe the commit didn't finished or internal Panorama processes, post-commit didn't finish.
Other admin had already pushed your commit changes, which can be seen in the Task window
Your user does not have access to push changes (based on your admin roles)
Template stack has no firewall assigned.
Firewalls are not reachable by Panorama (connected).
Is it possible to validate the above list and, in case it's none of the above, to present some more details?
I hope this helps.
... View more
09-08-2023
10:44 AM
Hello @Cristian_Soler ,
In theory, even if you have a single tunnel interface in a hub-and-spoke topology, you would have multiple ISAKMP and IPSec sessions, one for each spoke (like Cisco has with DMVPN and other VPN technologies). As far as I know, a tunnel interface can have up to 250 proxy IDs.
The information presented above is the platform limit presented by Palo Alto regarding IPSec VPNs.
I hope this helps.
... View more
09-06-2023
08:38 PM
Hello @Cristian_Soler ,
According to the product specification, a PA-460 can have maximum of 2800 IPSec Site-to-Site VPN peers.
Please find more information on this link by searching for your product.
I hope this helps.
... View more
07-17-2023
10:01 PM
Hello @JohnWade,
The short answer would be "Yes".
As OtakarKlier mentioned, QSFP-40G-SR-BD SFPs are compatible with PA- devices and will be visible in the "show system" CLI command, as CISCO-AVAGO. The 1Gbps Cisco SFPs, however, might be seen as CISCO-FINISAR.
I hope this helps.
... View more
07-09-2023
08:06 AM
Hi @YotamS
Try following this KB. Maybe this is what you're looking for.
Let us know if this helped.
... View more
06-23-2023
01:06 AM
Hi @Richard_M ,
If you know when this was done, I would use the Config Audit menu in Panorama -> Config Audit
In there you'll be able to see exactly what has been changed and you should be able to see the device serial number that was removed from the device group and rules (if the targets were not "any").
... View more
06-02-2023
09:37 AM
Hi @Matlu_NN ,
It could be that you're looking for the "test routing fib" CLI command explained in this KB article.
Let me know if this helps.
... View more
05-30-2023
10:54 AM
@Khushnood
The idea of the audit comment is to have a trail of what has been changed in that rule. Basically it will always ask you to put something there every time you do something to that rule or any other rule (add/modify).
You can see all the comments by clicking on the Audit Comment Archive at the bottom of the rule.
Here you can find a description on how this feature works and how you can disable/re-enable it.
I hope this helps.
... View more
05-30-2023
10:42 AM
@GantaphonW
I would say this is expected to have 1 ping timeout (that would be 1-2 seconds depending on how you test). You have to keep in mind on what's going on the the background like the GARP that the firewall is sending plus the CAM tables being updated on the switches to follow the new path.
From my point of view I could try with LACP Fast + Fast Failover + STP Portfast Trunk on the Cisco side to make sure STP does not come into play.
If the ICMP test was done from a Windows machine try using "-w 1" as parameters which will decrease the ICMP timeout from the default 2s to 1ms (which actually is still 1 second since Microsoft cannot go below 1second). If you still have a timeout then you know it's a "downtime" of maximum 1 second.
I wouldn't consider this as a major impact since TCP has it's own retransmission timers and most of UDP applications have the retransmission inside the application. The voice itself will have a subtle glitch in my opinion.
I hope this helps.
... View more
05-30-2023
10:33 AM
Hi @Khushnood
It appears that you have the the "Require audit comment on policies" enabled in Device -> Setup -> Management.
You can either put a comment there or disable the setting, depending on your security policies.
I hope this helps.
... View more
05-30-2023
10:18 AM
@GantaphonW ,
I would also enable Fast Failover like @BPry suggested and add check the Enable in HA Passive Sta te (in case you have HA) due to the fact that the standby unit will be down unless it's checked and, in case you Cisco switch does not have spanning-tree portfast trunk enabled it will go through all the STP states. Another thing would be the LACP Fast transmission rate that might force the Cisco side to suspend the port-channel faster (1s compared with 30s).
From my point of view, it depends on how you've decided that one ICMP timeout happened during the failover. Is it from the outside interface (which could be different from the port-channel) or from a subinterface of that port-channel?
I hope this helps.
... View more
05-30-2023
08:48 AM
Hello @Ants
Another way is to make use of the Microsoft Endpoint List which is published weekly (and updated every Friday as far as I know) to create a custom EDL which can allow only parts of the O365 that you like.
I hope this helps.
... View more
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks