About Sly_Cooper

We faced similar issues again after upgrading Panorama to 10.2.2. If the issue is for Panorama, then before working on editing the configuration file, please try restarting the management service on Panorama. It solved issues for us when Panorama could not push config to the firewalls (Panorama version 10.2.2, Firewalls version 10.1.5) ... View more

One of my colleagues worked on editing the xml config and re-importing the config in Panorama. It resolved the issue. It was a hassle. Palo Alto needs to resolve this issue in the PAN-OS. ... View more

I tried the CLI option. I could see the hip-profile config for the rule, however, delete command does not have hip-profile option for removal. I replace set with delete and use the same config, then it complains about invalid syntax. Looks like a bug. ... View more

I am facing a similar issue, however for the Authentication rule. I tried it via CLI. I do see a hip-profile match, however, there is no matching option for the delete command. delete rules <rule-name> authentication-enforcement Authentication enforcement object to use for authentication. category category description description destination destination destination-hip destination-hip disabled Disable the rule from from group-tag group-tag log-authentication-timeout log-authentication-timeout log-setting Log setting for forwarding authentication logs negate-destination negate-destination negate-source negate-source service service source source source-hip source-hip source-user source-user tag tag target Target devices timeout expiration timer (minutes) to to <Enter> Finish input Here is config for the policy. set device-group <GROUP-NAME> post-rulebase authentication rules <RULE NAME> hip-profiles any   ... View more