About wittejj

The PA-500 has an ARP limit of 500. The PA-2020 has an ARP limit of 1000. The PA-2050 has an ARP limit of 2500. I was able to work around the issue by front ending the firewall with a router or a L3 switch.  It worked pretty well for our environment. One other thing to note is the firewall bandwidth limit of the PA-500 is 250Mbps. Hope this helps. ... View more

James, I would think that you would have to purchase a license.  I know this may not be preferable, but you can always forward your logs to a syslog server. John Witte ... View more

Paul, I don't know if they have that listed.  I can tell you that we are running 4.1.5 and 4.1.6 in our environment of PA500/PA2020/PA2050s and I haven't encountered any problems.  The only thing I do is I don't get in a big hurry to update to the latest version because every now and then they release a version that has a serious bug.  For example, the release of the 4.0.0 code was so buggy that they pulled it and released 4.0.1 a few weeks later. You also have to watch the Dynamic Updates because I had one that i installed that fouled up FTP access and they had to issue an emergency release to address it. I know that doesn't really answer your question, but ultimately Palo Alto will probably "recommend" that you update to the latest release in a particular software train. John Witte ... View more

I can't really see them releasing a Panorama appliance when they have configured Panorama to support NFS. We're running NFS on our Panorama installation and so far so good. ... View more

The User Agent software can be quite chatty.  If the User Agent is configured to talk to the other DCs, then it will query all of their user data.  Based on my observations, the user agent software can generate between 1 to 2Mbps of traffic between itself and the DCs. If any of those DCs are connected to the core via a T1 line, then it could easily swamp the WAN network. The recommendation mentioned previously is the best.  I would suggest installing the user agent software at the remote locations and then configure the PA firewalls to use the additional user agents. ... View more

I would think that you could do it.  The key is that the management IP addresses for the PA devices would have to be accessible to Panorama.  I could think of the following scenarios to address it: 1)  The management IP addresses for the devices share a common network and that network is accessible to Panorama. 2)  The devices all have different external IP addresses and you set up a service route where the Panorama communications uses the external interface. Another challenge that you would have to deal with is  to make sure that all object creation would be specific to each device group. In other words, none of the objects would be shared between the device groups.. ... View more

I would recommend Google Chrome as the browser to use for Palo Alto management.  I'm running 4.0.3/4.0.5 and I use Chrome for all of the management.  While I wouldn't call it speedy, I do think it performs better than IE and Firefox. Just my two cents. ... View more

I think Panorama is useful and I like using it, but it took me some time to adjust my perception of things so I understood what's going on.  The things that gave me the biggest difficulty with Panorama were the following: 1) What exactly shared objects are and how  they relate to the devices.  While it's listed in documentation, you don't really understand the shared resource thing until you actually deploy it and get hammered with error messages because you've defined duplicate named objects,services, etc on the devices.  That's when I discovered that for us the best way to handle it was to build ALL of the objects, services, etc on Panorama and push it to devices whether they needed them or not. 2) Realizing that all because Panorama is a centralized management platform, doesn't mean that everything is centralized by default.  For example, by building the policies on Panorama, I assumed that the logs would automatically be sent to Panorama.  NOPE.  You have to manually configure the rules  to be sent to Panorama.  In retrospect, it makes sense now, but in the beginning you just assume that a centralized management platform will do things  like that behind the scenes. I do think that its greatest strength is being a centralized POLICY and LOGGING platform rather than a DEVICE MANAGEMENT platform.  Normally I NEVER switch to a device context in Panorama.  I usually just log into the devices directly to make the configuration changes.  But that still doesn't diminish my opinion of Panorama. ... View more

Our 6 Pan Agents are used for six different domains.  Each one is only configured to point to the two domain controllers at that location.  The PA collect user data from all of the User Agents so in our environment every one of them is a primary. I should clarify our setup.  We only have one Pan Agent server for each domain.  It sounds like you have a several backup PAN agent servers for a single domain. ... View more

The User ID Agent software is quite chatty.  In our environment the User ID Agent server has a consistent throughput of 2Mbps. To be fair, this server is also used for the Websense DC Agent server, but I'm pretty confident that the bulk of the traffic is from the PA side of things. In our environment we have 6 different user ID agent servers and they are all collocated with the domain controllers.  Someone mentioned that the firewalls can only talk to five user agent servers.  We have six and the firewalls here see them just fine.  So, I can at least say that at least six will work.   ... View more

I understand that, and I currently have a support ticket in with support. I'm merely posting my observations and based on my observations, Firefox provides the best overall experience. Even on the forums, PA has admitted as much. ... View more