About Deepak_K

Due to high cpu utilization in firewall , we want to use dataplane interface of firewall for user-id services. Currently , when primary firewall failover to secondary we do not require to change master device in panorama device-group. How panorama collecting user-id info if primary firewall which selected as a master in device-group becomes passive ? What if Primary firewall goes completely down ? If we use dataplane interface, do we require to change master device in Panorama device-group if failover happens ?    ... View more

We are managing 4 location HA pair from Panorama and collecting logs using management interface of M200. (all devices and panorama in same data centre) Sometimes we observed delay in logs and commit operation , but mgmt cpu of M200 is less than 50% at that time. mgmt cpu utilization in panorama is showing utilization of only mgmt interface or overall utilization of box ?     ... View more

We have a requirement of finding Location of our Work from home users. Currently we are able to extract the Report with country.   So now we want to extract the User’s accurate geo location. There are approx. 5000 VPN users. I got to know that Prisma access has Autonomous Digital Experience Management (ADEM).   Please let me now if this solution or any other solution can mitigate the requirement. Thanks.   ... View more

We are using one VOIP application over internet which is disconnecting after drop in 2-3 packet. For seamless connectivity we are looking for ISP failure if 2-3 packets are dropping. We can configure path monitoring ( By default ping interval is 3sec and count is 5) .  We want to know this path-monitoring will fail after 15 consecutive pings or how it is ?   In first interval if first two pings are successful and for rest three if there is no response so can we consider this three failed pings under 15 consecutive ping ? all 5 pings in each interval should be require to fail to trigger the path monitor failure ?   ... View more

On upgrade to PAN-OS 10.0, the Panorama management server checks for duplicate addresses in address groups ( Objects > Address Groups ) and services in service groups ( Objects >  Service Groups ), and fails to commit any configuration changes if duplicate address objects and services exist. Workaround:   Before you upgrade to PAN-OS 10.0, modify your address group and service group configurations and rename any duplicate address objects or services. Please find below link for reference : https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-new-features/upgrade-pan-os/upgradedowngrade-considerations.html   Usually in any software versions Panorama or Firewall doesn't allow same name address objects and service object in address group and service group respectively. Then why above consideration mentioned in upgrade/downgrade consideration document for Panos 10.0 ?    ... View more

We have query regarding log collector group  while upgrading Panorama M200 Ha pair from PANOS 9.1.6 to PANOS 10.0.5. Is there any issue in log collector status or log forwarding to collector group ? We have  log collector group( with enable log redundancy) and  local log collector of both panorama are added into same LC group in our production setup. HA and log collection config using management interface on both panorama.   We have tested Panorama HA upgrade from PANOS 9.1.6 to PANOS 10.0.5 on testing setup.(We couldn't configured LC in testing setup) First we have upgraded Primary Panorama to Panos 10.0.5 , when it came up it went to non-functional state due to panos version mismatch. HA1 was up and secondary panorama became active.   To make the upgraded Primary panorama device functional had to suspend Secondary panorama. HA1 was up even after suspending Secondary panorama.   Is there any issue in log collection or LC status if we suspend secondary panorama  If yes, then logs should redistribute from LC1 (pri panorama ) to LC2 ( Sec panorama ) after making secondary panorama functional.   We want to keep production Sec Panorama in suspend state and want to monitor upgraded pri panorama for 7 days. So after upgrading panorama after 7 days , LC2 of sec panorama should have some logs stored in its logging disks.       ... View more

We are not able to access passive firewall on web gui and ssh. HA1 is configured on Dedicated interface. In high availability status , peer ip is not showing. What could be the reason.       ... View more

We are not able to connect VPN hosted in vpn_dmz zone. We have deployed third party vpn in vpn_dmz zone and configured inbound nat for same. Its old setup , all of sudden we are unable to connect vpn intermittently.   did pcap for vpn public ip , showing below counter after running "show counter global filter packet-filter yes delta yes severity drop" command tcp client reset via TCP responding rst: ... View more