About acc6d0b3610eec313831f7900fdbd235

Hi @JDominguez   Based on your description, there are two applicable options: Standalone Deployment and Small Single Site Deployment.   Standalone Deployment    This design is typically recommended for initial proof of concept (POC) or a small site with fewer than 3000 Traps agents, use a standalone deployment to install the following Endpoint Security Manager (ESM) components on a single server or virtual machine: • ESM Server • ESM Console • Forensic (quarantine) folder • Database I don't recommend to any of my customers to use this design in production, as it does not provide any redundancy for console or cores.       Small Single Site Deployment   As per the link you posted, and the official admin guide, this design requires:   One dedicated database server One ESM Console for managing the security policy and Traps agents Two ESM Servers, one primary and one backup, on the same network segment as the database server and ESM Console One forensic folder accessible by all endpoints for storing real-time forensic details about security This is the minimal I always recommend to all my clients due to the redundancy aspects and flexibility.   Now to your questions. My recommendation is that you adopt the Small Single Site Deployment 1 x ESM Console + Core (Combined) 1 x ESM Core (Redundancy) 1 x Database Server - Notice that SQLITE is no longer supported or recommended by Palo Alto even in POCs; hence, the official recommendation for environments with more than 250 endpoints is SQL Server Enterprise or SQL Server Standard as per the below screenshot. Important: You only can have one console installed.   For further details on requirements please refer tothe following for the administrator guide: link: https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/technical-documentation/40/endpoint/endpoint-admin-guide.pdf  I hope this helps.          ... View more

@rrealica I had a meeting with the NSS engineers a few weeks back when the report was released, and the explanation was that it failed or did not do well, during the evasion tests. ... View more

Hi @Sadik_Khirbash My apologies for my fat finger. The command is: tail follow yes mp-log ikemgr.log  The phase 2 ProxyID is a crucial piece of this configuration, and it would be important for us that you ensure it configured properly. The concern is not the Phase 2 paramenters, but the Proxy ID configuration at this point. That's how your Proxy ID should be configured on the PA-200 side. Run the above command and post the output for us, then maybe we can shine some light on it for you 🙂   ... View more

Hi @TranceforLife According to this new feature guide, since PAN-OS 6.1 the "policy-deny" reason, is because the session matched a security policy with a deny or drop action. https://www.paloaltonetworks.com/documentation/61/pan-os/newfeaturesguide/networking-features/session-end-reason-logging In other words, the app-id or port being hit, does not match an explicity policy; hence, it is most likely hitting the interzone-default policy. By the way, the interzone-default policy (at the bottom of the rule base) is not logged by default; however, you can override this configuration.   Default Interzone Policy:  Default Interzone Read-only:   Default Interzone default action:     Override Default Interzone-Policy  Note: Click the Override button at the bottom of the screen       Change Default  Interzone default action:    The reason I want to log the session at the start is because the action is "Deny" or "Drop", and I don't care about having the full session view in this case. In other words, as soon as the traffic is denied, a log is generated right away and not only at the end of the session. I hope it makes sense.   Now to your original question, my point is that the policy-deny reason you are seeing is because the app-id or port is not explicitly placed in an allow policy; hence, it will hit the default deny (Interzone) policy, which is not logged by default, as I stated before.   I hope this helps.                                         ... View more