About ce1028

As you all know, Palo Alto gives you two ways to exclude sites from decryption.  Are there any scenarios where excluding from SSL Decryption Exclusions works but setting the same url in a decryption policy doesn't?   I ask because I've had the scenario where I get a certificate validation error using an app, I look at the cert and see it's for a URL that I have excluded via decryption policy, yet the error shows my internal CA as the root ca (which means it was decrypted) ... View more

I have a question about upgrading a firewall to new model.  I've done it in the past but always seem to forget the order.   I have a firewall that is managed by Panorama, with some local policies also.  I have downloaded the device state from the existing firewall.  I have also added the serial number of new firewall to Panorama but I have not configured the blank firewall with the Panorama IP address yet.   Do I have to connect the blank firewall to Panorama first, wait for it to show connected in Panorama, push to new firewall and then restore the device state to new firewall?  I feel like the order of operations may be wrong here ... View more

Hello everyone,   I have question.  I inherited a few firewalls that are partially managed by Panorama, meaning I have objects and other items pushed to the firewall from Panorama but mostly everything else is local.  On the local firewall, contains all firewall rules, zones, interfaces are configured with ip addresses.  The other firewalls are fully managed by Panorama.  Not ideal but the real problem is I cannot create shared security rules in Panorama for all my firewalls since no zones exist for these few firewalls.   My question is, can I safely create the zones with the same names in Panorama for these device groups and push it out to the firewalls without impacting the interfaces on the local firewall   Once I can get the zones in Panorama, I can slowly create matching firewall rules and get rid of the local rules   ... View more