About mschuricht

mschuricht · ‎09-23-2013

The entire config is pushed during the commit and not just the changes.

mschuricht · ‎09-05-2013

This behavior is expected. Please follow up with your SE if you would like further reporting/monitor/ACC granularity in Panorama.

mschuricht · ‎09-04-2013

Please contact your SE for any questions regarding roadmap.

mschuricht · ‎08-30-2013

Marcus, The rights required to use the Device > Setup > Operations are at the superuser level and there is no way to create a custom Admin Role with superuser privilege. If you need these rights you should use the superuser dynamic role instead since you are giving superuser rights in the CLI anyways. If you look at the "Role" setting in the admin role it will be set to "Device" which means the admin has rights equivalent to a deviceadmin. We are looking into eliminating offering "superuser" or "superreader" rights on the CLI under the custom admin role since it does not make sense to allow this escalation of privilege when logging in via CLI for the same admin who is a web interface deviceadmin.

mschuricht · ‎08-29-2013

50K objects is quite large. Are you actually using all of those objects? This seems like a case for consolidation if possible to subnets and ranges where applicable as well as removing any unused objects. Here is a script to identify unused objects to aid in a diagnosis: Unused and Duplicate Address Object Script I would probably recommend moving to 5.1 for 64 bit support if you cannot reduce the number of objects. 5.1 requires 4 CPU cores and 4GB RAM at minimum. For a larger config it is recommended to move to 16GB of RAM. The release notes outline the recommended requirements as well as upgrade procedure if you decide to go this route.

mschuricht · ‎08-29-2013

TAC can help and they will also need to open a bug so we manage the files correctly and this situation is avoided for future customers.

mschuricht · ‎08-28-2013

Please answer the following questions: How many objects do you have in total? How many device groups do you have? What is the RAM and CPU allocated to Panorama?

mschuricht · ‎08-27-2013

Eric, If a setting is not configured in a template, then the template is not going to affect local device config regardless of checking/unchecking "Force Template Values". The force will only remove local device configuration for settings which are configured in a template and overlap. Mike

mschuricht · ‎08-15-2013

This will not be an officially supported method of alignment.

mschuricht · ‎08-14-2013

Anything forward looking which is a feature and not a bug would require NDA. We want to set expectations appropriately since any forward looking info can affect new or existing customer actions/decisions. Changing the alignment is not a bug.

mschuricht · ‎08-13-2013

This will work if you want to restrict log access when context switch occurs while the admin is logged in locally to a device though Panorama. The other request to restrict access without a context switch while inside the Panorama Monitor tab is a current feature request. We are tracking this request as we move forward to plan future releases. Please follow up with your SE to add to the FR if you have not already.

mschuricht · ‎08-13-2013

I asked engr to take a look at the effort of an alignment change based on this thread and a couple other requests. This does not guarantee when or if a new base image will be released since it requires QA testing and verification. I think there may have been a misunderstanding about this between Engr and Support based on some comments in an enhancement bug. I'll speak with support to make sure this is being communicated correctly. Please contact and rely on your SE regarding forward looking statements. They will be able to put you in touch with a PM who, under NDA, can make forward looking statements.

mschuricht · ‎08-13-2013

We will look into this request and consider it as a potential feature request for a future release. This does not guarantee if or when we would release a version with changed alignment. Please move forward with the deployment today since there does not appear to be a performance issue that you are running into and the request seems to be associated with best practice for more efficient read/writes.

mschuricht · ‎08-08-2013

You could use Panorama and the script to alter the associated Security Profiles (e.g. Vuln protection, URL filtering). When doing the DG commit you could uncheck the "Merge with Device Candidate Config" option to avoid including any changes on the local device during the config push. This will have the same issue though if changes are being made in a Panorama DG since all config in the device group will be pushed.

mschuricht · ‎07-23-2013

Please take a look at the new Panorama Administrator's Guide 5.1 which has information about using Panorama which is applicable to older versions as well.

mschuricht · ‎07-22-2013

Export, search and replace, and reimport will fix many of your problems. Another option is to use the new 5.1 feature for quick RMAs. The release notes/Panorama admin guide talks about using the replace command, scp export device-state ..., and then import of the file on the new FW.

mschuricht · ‎07-19-2013

Can you explain the performance problems you experienced with the misalignment? At what logging rate were the problems encountered?

mschuricht · ‎07-12-2013

Please speak with your SE about setting up a call PM.

mschuricht · ‎07-11-2013

@mikand Correct, Panorama uses an internal acknowledgment mechanism over a TCP/SSL channel for log forwarding. Panorama does not currently support forwarding any logs which it did not internally generate. Thus, logs from devices cannot be sent from Panorama to a syslog server.

mschuricht · ‎07-09-2013

Correct. Please follow up with your SE to file an FR if you would like a possible future enhancement.

mschuricht · ‎07-09-2013

Panorama is tested and supported for the ESX platform and not workstation/server/player/fusion/etc. This has been the official support since the 5.0 release timeframe and should be specified in spec/data sheet as well as the Panorama admin guide. I would recommend ESX for the PoC since it would be the actual production deployment platform and it will yield similar results/performance.

mschuricht · ‎07-09-2013

The larger image will work as long as it meets the max size restriction to accomplish your goal of alignment offset. The max image size is documented in Admin Guide and Web UI.

mschuricht · ‎07-08-2013

There is no setting to tweak the location in the configuration. However, you can use an image editing tool to copy the desired image into a larger image with background color to accomplish your goal. The max size of the image that can be uploaded is specified in the documentation and in the Web UI when configuring.

mschuricht · ‎07-01-2013

Please open a case with support for further investigation.

mschuricht · ‎06-28-2013

I have seen these errors in the past when there are DNS resolution issues. Is the DNS server that is in Device > Setup > Services working correctly? Can you ping a FQDN and have the DNS resolve an IP?

mschuricht · ‎06-27-2013

It seems like the best solution when there are lots of logs is to avoid using a scheduled export and instead focus on using syslog forwarding plus collection.

mschuricht · ‎06-21-2013

Please open a case with support.

mschuricht · ‎06-17-2013

We can help investigate what happened if you open a case with support. Hopefully, we will be able to restore the lost config/logs.

mschuricht · ‎06-11-2013

Correct, the secondary can act as an independent collector and logs can be forwarded directly to the M-100 from 5.0 FWs via the Collector Group > Log Forwarding configuration. Correct, either M-100 (primary or secondary) can be used to run reports or view logs which will be correlated across both Panorama HA pairs. To make this work you will need to configure the primary and secondary M-100 as Managed Collectors on the active box so that the config has both M-100s referenced. This will sync to both devices on Panorama commit and then you can add the secondary collector to a new independent log collector group, do a Panorama commit, and then a Collector Group commit. This should result in the configuration you desire. Note: You will also need to configure the Log Forwarding tab inside the Collector Groups to setup which FWs you want forwarding to the primary vs. secondary M-100.

mschuricht · ‎06-06-2013

Please talk with your SE about any roadmap related inquiries.

Date Registered	‎06-08-2010 09:58 AM
Date Last Visited	‎08-18-2015 09:06 AM
Total Messages Posted	226
Total Likes Received	39

Online Status	Offline
Date Last Visited	‎08-18-2015 09:06 AM

Strata

Prisma

Cortex

About mschuricht