About TomMeadows

@KennethMcRae, Just throwing this out there as an option, but if you have a small node on-site you could use to run a script you can automate a configuration roll-back through the API fairly easily. Ideally this actually gets implemented directly in PAN-OS, but it's a viable option for those that don't use Panorama who want this functionality.  ... View more

Hi Tom, For the first point, if you the objective of the monitoring is to fallback then the Disable option should be checked. However if there is no alternative path, and the objectective is just to detect path failure, then the Disable option should not be checked. For the second point if there is no monitor "IP Address", it will monitor on the "Next Hop". However if there is monitor IP address it will monitor on it instead of the Next Hop. No need to monitor the next hop separetly as it will be used on the way to the "IP Address" anyways. Hope this make sense. ... View more

That seems the answer Travis.    I did work this out myself afterwards, by looking at the available command completion options on CLI and noticing the zone information associated with from and to parameters.   I still think a bit odd that Palo Alto Knowledgebase example doesn't use them though.   Thanks.   ... View more

Just to add here, the pbf rule will take effect only for systems behind Palo Alto  and not for the traffic sourced from firewall interface. Now coming to your issue, the PBF was down when monitored was enabled.   Can you please try by changing monitoring IP  and check if it works ? I have configured PBF on my PA220 and it is working without any issues but it is running on 9.0. Check once with TAC also if it is bug.   - Mayur ... View more

Thanks for all responses.   Reaper. I very much appreciate your detailed explanation, together with screenshots. I wasn't aware you could override the default clear-text profile on a QoS Interface object to differentiate depending on the source interface.   That was exactly what I was trying to do, and I think this will work well for us.   To the other posters:   Otakar - I don't believe our ISP does support QoS tagging. Steve- I think you're describing the same solution Reaper has suggested.   Thanks all! ... View more

You can access it via the CLI:  show pbf rule name <your-PBF-Policy-name>   You can script that using SSH connections with password-less keys.  Just run it every X minutes and compare the "Rule State" line between runs.   Unfortunately, it will fill your logs with login/logout entries.  😞   Would be really nice if this could be polled via SNMP, or configured as an SNMP trap, or some other more automated way. ... View more

I too would be interested to know if it is possible to use port-channels as a resilience model in an Active-Passive Palo Alto environment. Does anyone do this, or know whether it is possible?   Thanks, ... View more