About Neil_Xu

What version of the code are you running on Panorama and your Firewalls? ... View more

@Danimal   Not sure if you've addressed your issue.   Recently I've ran into a similar situation where a vendor's software does not addresses the TCP timeout properly, which I had to create an customized AppID for it in order to customize the TCP timeout values for that particular traffic.   Here's what I did:      - Navigate to Objects --> Applications --> Add      - Configuration Tab:               - Name: Name your AppID               - Description: Some documentation about this AppID               - Category: business-systems               - Subcategory: office-programs               - Technology: client-server               - Parent App: None               - Risk: 1      - Advanced Tab:               - Defaults: Port               - Port: port(s) or your application uses               - Timeouts --> TCP Timeout: <tcp timeout value>      - Policies --> Application Override --> Add               - Enter the basics of the traffics flows for the application override policy.                  - Name                  - Src Zone                  - Src Address                  - Dst Zone                  - Dst Address                  - Protocol                  - Port                  - Application: <your custom AppID name>   I learned that the Application Override policy is the policy that will POINT the matched traffic pattern to a specific AppID (custom or OOB)   Hope this helps or at least shine a light to your problem.       ... View more

Actually, Cisco has made EIGRP an open standard per RFC7868 since 2016.     We'd love to see Palo Alto firewalls implement EIGRP as a supported routing protocol where it will be much easier to intergrate with an already established Cisco network topology.     Currently, we still have Cisco ASA/FirePowers for this sepecific reason (EIGRP)...  Just drop it in and it works, without redoing dynamic routing configuration and involve various other teams.     ... View more

@Remo Yes, this workaround worked for me, but not ideal and Palo is working on resolving this issue.   I'm sure you know and have done these, but this is the step-by-step:   1 - Make sure that at the local firewall level that the zone and interfaces are inherent to that of Panorama's configuration.  2 - Execute "Commit All Changes" on the panorama, then "Push" it to the local firewall. 3 - Refresh the page (F5) for the local firewall web interface.    I'd say if this still doesn't work for you, then you may have a separate issue that support need to be involved.  The good thing is that support already have (or know) simuilar issues and they can perform a debug to follow the logs on the firewall to your sepicific issue.   Hope this helps some...      ... View more

We just had simular issue.   This is related to the bug that was though to be address in 8.1.7, but it resurfaced in 8.1.8.   Here is support's response.   "...   As discussed, it looks like a bug in JIRA (PAN-118603 duplicated with PAN-119175) in PAN-OS 8.1.8 where Partial local commit on Panorama is not applying changes to shared address groups. In this case we tested and this bug also applied to the security zone in network tab. Workaround is do a "Commit All Changes" to the panorama and then push to devices. Note: The report showed the issue is not visible in PAN-OS 8.1.7, but issue is visible in PAN-OS 8.1.8. Our engineering team is still working on the fix for that issue. It may get fixed in PAN-OS 8.1.9.   ..." ... View more