About Alberto.Espinosa

Hi,   I have a question regarding changing master key for firewalls from Panorama and its consequences. My situation is the following: - Two Panorama servers in HA - Two PAN Firewalls in HA (let's call it as HA cluster 1), already managed by Panorama   Seems that I changed the default master key for the firewalls but I don't remember what is the current master key.   The problem is that now I have to deploy two new firewalls in HA (let's call it as HA cluster 2) to be managed by Panorama. I know that Panorama and all managed devices should have same master so I want to change the default master key of HA cluster 2 to a new one, but as I don't know the current master key for the HA cluster 1, how I should proceed?   More questions I have: - How affects to Panorama having two different master keys for HA managed devices? - There is some cautions I should have prior to change the master key for the second firewalls cluster (HA cluster 2)?   I'm not sure if I should factory default the already deployed cluster (HA cluster 1) to reset the master key, and then deploy same master key to both HA cluster managed by Panorama.   Thanks in advance! Alberto ... View more

Hi all,   I have a doubt regarding the synchronization of BGP routes learnt by the active firewall. Reviewing the BGP route informationin in the active node with the following commands: > show routing protocol bgp loc-rib > show routing protocol bgp rib-out   BGP seems is working fine in the active firewall, as the firewall has routes in his loc-rib table and advertise routes in his rib-out table.   But reviewing the same BGP information in the passive firewall, nothing is shown in loc-rib table and rib-out table.    As I can see HA A/P synchronizes the following runtime information: - Session Table - Neighbor discovery (ND) table - MAC table System runtime information synchronization: https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/high-availability/reference-ha-synchronization/synchronization-of-system-runtime-information.html#   But what about BGP routing information? This is the expected behavior? BGP routing information is not synchronized between HA active/passive? Should BGP routing information be synchronized between HA active/passive peers?   Any help is really appreciated as I'm not sure what is expected. Thanks! Alberto ... View more