About wittejj

The PA-500 has an ARP limit of 500. The PA-2020 has an ARP limit of 1000. The PA-2050 has an ARP limit of 2500. I was able to work around the issue by front ending the firewall with a router or a L3 switch.  It worked pretty well for our environment. One other thing to note is the firewall bandwidth limit of the PA-500 is 250Mbps. Hope this helps. ... View more

James, I would think that you would have to purchase a license.  I know this may not be preferable, but you can always forward your logs to a syslog server. John Witte ... View more

Paul, I don't know if they have that listed.  I can tell you that we are running 4.1.5 and 4.1.6 in our environment of PA500/PA2020/PA2050s and I haven't encountered any problems.  The only thing I do is I don't get in a big hurry to update to the latest version because every now and then they release a version that has a serious bug.  For example, the release of the 4.0.0 code was so buggy that they pulled it and released 4.0.1 a few weeks later. You also have to watch the Dynamic Updates because I had one that i installed that fouled up FTP access and they had to issue an emergency release to address it. I know that doesn't really answer your question, but ultimately Palo Alto will probably "recommend" that you update to the latest release in a particular software train. John Witte ... View more

What I've done at our location is set up some layer 3 subinterfaces on the ethernet port where the VLAN trunk connects to and I assign each subinterface to the appropriate VLAN.  For example, I would create subinterface ethernet1/1.100 for traffic in VLAN 100. In our installation  the main interface itself doesn't have an IP address assignment. Under the virtual router you would then add the subinterfaces to the router and then set up your routing appropriately depending on the type of routing you are going to do.  In our environment, I'm running OSPF routing so I had to set the subinterfaces up in the OSPF routing table. Hope this helps. ... View more