About Danny_Baldonado

I was having the same issue with an EDL for an IP List.  I was not seeing the EDL's "List Entries and Exceptions" populated, it was just showing 0.0.0.0/32 even though the "Test Source URL" was testing successfully.   So i created a new test a new test policy, added my IP EDL to it, and moved it to the bottom of my policy list in Panorama... Once i did that and pushed that out to the firewalls, then the EDL's "List Entries and Exceptions" populated with the listing i was expecting. Success!     A couple of suggestions for improvements, PAN folks....   First, It would be helpful if the documentation actually explicitly called out that the EDL will not populate its "List Entries and Exceptions" until it has been referenced in a policy. I do not see that mentioned in the documentation i was reading.  And in fact, this document is misleading (incorrect?) since it states " Before you  Enforce Policy on an External Dynamic List , you can view the contents of an external dynamic list directly on the firewall to check if it contains certain IP addresses, domains, or URLs".   Secondly, I feel like that is a bad process/requirement to have the EDL used in a policy first before it populates, since I was hesitant to add the EDL to a policy until i could actually see and verify that the listing was correct first.  Just my 2 cents... ... View more

I know you can have a shared SSL/TLS service profile in Panorama, but as far as i can tell (and from what Palo Alto support has confirmed as well), there's no way to then make changes to the protocol settings to disable ciphers from Panorama as well— that needs to be done as an override on each managed firewall. If this is not the case, please provide more details/examples of how to do this process from Panorama to be applied to all managed devices. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CmqeCAC peace, dannyB ... View more

Here's my feature request... It still baffles me that you can configure an SSL/TLS service profile in Panorama to be centrally managed and pushed out to all of your managed firewalls, but in order to reconfigure/disallow weaker keys and ciphers you need to manually override the template on each firewall and make the CLI changes on each firewall.   https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CmqeCAC   The fact that you can't manage this globally within Panorama is a huge shortcoming.  Please add this ability in future releases.   ... View more