About niyengar

you can always choose the byol option and enter the eval authcode in the bootstrap file. ... View more

The VMs are part of the budle so no need to buy additional VMs   Just note that we do not support PAN-OS stateful HA in Azure. You can deploy firewalls behind a load balancer and that will give you resiliency.   Availiability sets are more for when you want to account for planned and unplanned outages. Such as patching of the system, power failure etc.    I deally you will have your VMs in an avaialbility set and behind a load balancer. ... View more

What company do you represent?  If you don't want to advertise here, you can unicast me at niyengar[at]paloaltonetworks[dot]com ... View more

Hello,    In AWS the firewall needs to have an interface in the subnet for it to be able to see the traffic.    One other solution is to use a Transit VPC. This will be a centralized VPC with firewalls and then other VPCS with variouis APPS connect to this VPC to send data out (outbound protection) and you can also achieve inter-VPC security.   We are working on a  fully automated solution and it should be relased in the next few weeks. You can contact your SE and have them setup a meeting with folks here  @ paloalto networks and we'll be happy to give you an overview.     ... View more

What's the reason to do this?   I very much doubt you can update the agent on the firewall. ... View more

Oh...and as Warby suggested, please do open a TAC ticket o you can get the proper and timerly support you need. ... View more

That command is looking for a specific job id (id 1) and that is usually the auto commit job.   Can you log into the firewall and check the status of all jobs?   ... View more

What is your source on GitHub?   Just visually the xpath looks correct... ... View more

Is this using PANOS 8.0? I assume you are sending all your traffic directly to internet from your GP Gateway? ... View more

Did you modify the virtual-machine-password.json and/or virtual-machine-sshPubliKey.json? That is the template that deploys the actual VM-Seires and need to know how many interfaces to attach to itself.   "networkProfile": { "networkInterfaces": [{ "id": "[resourceId('Microsoft.Network/networkInterfaces',concat(parameters('nicName'),'0'))]", "properties": { "primary": true } }, { "id": "[resourceId('Microsoft.Network/networkInterfaces',concat(parameters('nicName'),'1'))]", "properties": { "primary": false } }, { "id": "[resourceId('Microsoft.Network/networkInterfaces',concat(parameters('nicName'),'2'))]", "properties": { "primary": false } }] } ... View more

Do you mean bundle 1 to bundle2? You can get a new auth code for bundle2 and activate it (but you may need to deactivate the previous license) ... View more

Hi,    My guess is that you need an alternative authentication method in the IKE gateway setup: Local Identification portion.   You can use email or fqdn and as long as they match on both sides it doesn't matter what it is... The guess is here that NAT is breaking IKE ... View more

Steve,    For outbound, just add a static route that forwards trafffic as you suggest. I *think* you can just forward it to eth 1/1 (an not mention the ip address of the subnet) of the fw -- assuming eth1/1 is what NIC1 is connected to.    The NIC in Azure has the public IP and the firewall doesn't even see it. It only see the private address. ... View more

What does you bootstrap bucket look like? Does it have four folders in the root bucket? Config, software, license and content? ... View more