About tcasw86

justamoment · ‎12-01-2021

Ah, I forgot all about sudo su. That worked - thanks!

tcasw86 · ‎05-18-2021

User account didn't have API permission

mikep97 · ‎08-23-2020

Hello, Its 2020 and i also had the same issues of all 8 of my nest protects and 2 cameras disconnect from the nest services. They were still on my wifi networks, i could see the dns requests hitting the firewall and a single http request, but that http request never got a response from the nest cloud. I figured out that my firewall had a bad entry in its dns cache for the nest cloud. Once i disabled the dns cache option on the firewall everything came back to life. Just thought i would post the solution here. Thanks, michael

tcasw86 · ‎11-01-2019

Updating the Expedition resolved the issue

tcasw86 · ‎09-09-2019

I'll have to check if I still have it in the migration tool. I ended creating a new project in the exact same manner as the one with the issue, the new one worked just fine.

jeremy.larsen · ‎03-28-2019

This one got me for awhile back when I did it. You are correct. You need to create separate templates ie - templateA & templateB. Then create a stack for each as well - stackA & stackB. The top template of each stack will be the templates mentioned above (highest priority, top to bottom). Usually I only include things specific the each firewall in these (HA configs, Hostname, etc). Once this is done, I will create a template for the pair/site/global. It's really up to you how you want to organze this. One thing to remember that had me hung up. A stack does not mean a stack of firewalls (ie - switch stack). It only means a stack of templates to be applied to a firewall. Let me know if the below example helps. Example: templateA (contains template specific to firewallA, ie - HA configs, hostname, etc) templateB (contains template specific to firewallB, ie - HA configs, hostname, etc) templateSite (contains template specific to the site HA pair) stackA (contains templateA + templateSite + anything others) -> applied to FirewallA (in order top to bottom) stackB (contains templateB + templateSite + anything others) -> applied to FirewallB (in order top to bottom)

sidetrack · ‎01-14-2019

Thanks for raising this, I have had the same question only to find out by trial and error. With the merge function I have found if an element can only have a single entry or configuration the name of which already exists in the config, it effectively REPLACES that element in the destination x-path. Where an element can have multiple entries (e.g. groups) the merge function will COMBINE the existing config with the new. Understanding this is helpful in case you have existing elements with the same name. I believe the Append function is designed for policies only, where the imported config is tacked on the end of the existing althouhg I would expect this to have the same result as a merge, especially when an existing rule has the same name (you can't have two rules with the same name even in a candidate config - the 'new' rule is probably going to merge with or replace the existing - I would suggest more trial and error or more consise documentation from PAN 🙂 I have done all my optimisation off-site so never had API access to the customer equipment, should that be the case I have no idea what would happen when pushing the conifg to Panorama via the API - would this merge, append or replace the destination element / stanza?

santonic · ‎06-29-2018

Thanx all for suggestions. In the end it turns out the second ASA was slowly 'abandoned' so nothing there to migrate 🙂 However i'm having issues converting policy from ASA 8.2 (as explained in different topic 😛 )

mivaldi · ‎04-19-2018

I see, please submit the issue through your reseller and we'll be happy to process their request.

santonic · ‎04-06-2018

It was a while ago, but yes we did and it worked.

tcasw86 · ‎03-06-2018

Most ISPs offer DDOS protection at additional cost. This is ideal as just relying on blocking only at the firewall level can still overwhelm an internet circuit, better to block upstream where possible.

EricJRein · ‎11-15-2017

Thanks for the responses! I "inherited" our Palo Alto's just four months ago (with no prior experince with them) and overall have been impressed with them. This is one area that I feel needs improving though. Also on the topic of URL Category is it possible to use IP addresses and not actual URL's when filtering websites? When I monitor the traffic for a site such as Mapquest I see several IP addresses being blocked but the "Resolve Hostname" feature does not always work for every address.

Member Since	‎04-19-2016 10:43 AM
Date Last Visited	‎07-20-2022 04:45 PM
Posts	30
Total Likes Received	1

Online Status	Offline
Date Last Visited	‎07-20-2022 04:45 PM

About tcasw86

Re: Pulling Panorama Config - Remote Exception

Pulling Panorama Config - Remote Exception

Unable to Save Additional Project Snapshots

Re: Expedition Not Correctly Importing NAT Policies from ASA

Expedition Not Correctly Importing NAT Policies from ASA

Re: DoS & Zone with no downtime

Re: Active/Active Firewalls and Panorama Templates

If You Need an OVA...

Re: Using Panorama shared objects

Re: Upgrade for HA Pair

Re: To drop or deny

Re: Unable to Save Additional Project Snapshots

Re: Pulling Panorama Config - Remote Exception

Re: Nest Thermostat

Re: Expedition Not Correctly Importing NAT Policies from ASA

Re: Zone Names not updating

Re: Active/Active Firewalls and Panorama Templates

Re: Load Partial Config: merge vs append

Re: Merging 2 ASA configurations into 1

Re: Thread-Log: Virus found

Re: Cisco SFP+ Twinax Copper Cables to PA-5050

Re: DoS & Zone with no downtime

Re: Allowing Mapquest