About wittejj

The PA-500 has an ARP limit of 500. The PA-2020 has an ARP limit of 1000. The PA-2050 has an ARP limit of 2500. I was able to work around the issue by front ending the firewall with a router or a L3 switch.  It worked pretty well for our environment. One other thing to note is the firewall bandwidth limit of the PA-500 is 250Mbps. Hope this helps. ... View more

James, I would think that you would have to purchase a license.  I know this may not be preferable, but you can always forward your logs to a syslog server. John Witte ... View more

Paul, I don't know if they have that listed.  I can tell you that we are running 4.1.5 and 4.1.6 in our environment of PA500/PA2020/PA2050s and I haven't encountered any problems.  The only thing I do is I don't get in a big hurry to update to the latest version because every now and then they release a version that has a serious bug.  For example, the release of the 4.0.0 code was so buggy that they pulled it and released 4.0.1 a few weeks later. You also have to watch the Dynamic Updates because I had one that i installed that fouled up FTP access and they had to issue an emergency release to address it. I know that doesn't really answer your question, but ultimately Palo Alto will probably "recommend" that you update to the latest release in a particular software train. John Witte ... View more

I can't really see them releasing a Panorama appliance when they have configured Panorama to support NFS. We're running NFS on our Panorama installation and so far so good. ... View more

The User Agent software can be quite chatty.  If the User Agent is configured to talk to the other DCs, then it will query all of their user data.  Based on my observations, the user agent software can generate between 1 to 2Mbps of traffic between itself and the DCs. If any of those DCs are connected to the core via a T1 line, then it could easily swamp the WAN network. The recommendation mentioned previously is the best.  I would suggest installing the user agent software at the remote locations and then configure the PA firewalls to use the additional user agents. ... View more

I would think that you could do it.  The key is that the management IP addresses for the PA devices would have to be accessible to Panorama.  I could think of the following scenarios to address it: 1)  The management IP addresses for the devices share a common network and that network is accessible to Panorama. 2)  The devices all have different external IP addresses and you set up a service route where the Panorama communications uses the external interface. Another challenge that you would have to deal with is  to make sure that all object creation would be specific to each device group. In other words, none of the objects would be shared between the device groups.. ... View more

I would recommend Google Chrome as the browser to use for Palo Alto management.  I'm running 4.0.3/4.0.5 and I use Chrome for all of the management.  While I wouldn't call it speedy, I do think it performs better than IE and Firefox. Just my two cents. ... View more

I think Panorama is useful and I like using it, but it took me some time to adjust my perception of things so I understood what's going on.  The things that gave me the biggest difficulty with Panorama were the following: 1) What exactly shared objects are and how  they relate to the devices.  While it's listed in documentation, you don't really understand the shared resource thing until you actually deploy it and get hammered with error messages because you've defined duplicate named objects,services, etc on the devices.  That's when I discovered that for us the best way to handle it was to build ALL of the objects, services, etc on Panorama and push it to devices whether they needed them or not. 2) Realizing that all because Panorama is a centralized management platform, doesn't mean that everything is centralized by default.  For example, by building the policies on Panorama, I assumed that the logs would automatically be sent to Panorama.  NOPE.  You have to manually configure the rules  to be sent to Panorama.  In retrospect, it makes sense now, but in the beginning you just assume that a centralized management platform will do things  like that behind the scenes. I do think that its greatest strength is being a centralized POLICY and LOGGING platform rather than a DEVICE MANAGEMENT platform.  Normally I NEVER switch to a device context in Panorama.  I usually just log into the devices directly to make the configuration changes.  But that still doesn't diminish my opinion of Panorama. ... View more

Our 6 Pan Agents are used for six different domains.  Each one is only configured to point to the two domain controllers at that location.  The PA collect user data from all of the User Agents so in our environment every one of them is a primary. I should clarify our setup.  We only have one Pan Agent server for each domain.  It sounds like you have a several backup PAN agent servers for a single domain. ... View more

The User ID Agent software is quite chatty.  In our environment the User ID Agent server has a consistent throughput of 2Mbps. To be fair, this server is also used for the Websense DC Agent server, but I'm pretty confident that the bulk of the traffic is from the PA side of things. In our environment we have 6 different user ID agent servers and they are all collocated with the domain controllers.  Someone mentioned that the firewalls can only talk to five user agent servers.  We have six and the firewalls here see them just fine.  So, I can at least say that at least six will work.   ... View more

I understand that, and I currently have a support ticket in with support. I'm merely posting my observations and based on my observations, Firefox provides the best overall experience. Even on the forums, PA has admitted as much. ... View more

I'll make this super easy for you. Generally speaking, Firefox is going to be the best browser to support the GUI for the Palo Alto environment.  It seems to provide the best performance and the greatest level of stability. I've also used Google Chrome and had pretty good luck. There are several bugs related to using IE for the Palo Alto configuration.  I ran 3.1.6 for awhile and I had some quirky problems with IE.  There's also the classic bug in 4.0.1 using IE where the service gets set to "None" when you create a brand new rule from scratch.  I'm currently running 4.0.3 and I still have trouble logging into my PA equipment with IE 8.0.  My current problem is that I have Web-GUI certificates installed on all of my equipment and when I attempt to logon to a couple of the units using the certificate it doesn't work.  If I login to them and bypass the use of the certificate it works fine. I know my answer is super generic, but Firefox is really the best way to go with the PA environment. With regard to the SSL-VPN, I really can't say because we don't use that feature.  My focus is on the management of the device. Hope this helps. ... View more

My guess is that the BIND DN isn't working because you didn't specify the complete path to where the service account is located.  Since it can't find the account, it triggers an invalid credential error. When you entered the BIND DN, did you include the complete path where the service account is located? For example, in our environment the service accounts are located under the Accounts OU in AD. So the bind DN would be  cn=serviceaccountname,ou=Accounts,dc=xyz,dc=com. ... View more

I've seen the same situation here, and we are currently running 3.1.6 version of the PAN-OS and Panorama.  Is this something that is addressed in the 4.0.x codebase? ... View more