About reaper

QoS is applied on the ingress of a packet, so if you want to limit upload you need to add the profile on AE1, if you want to limit download you need toi add the profile to AE5 (and if you want to control both you'll need a profile on both the interfaces)   this also means if you want to set up subnets in the cleartext section, you'll need to account for both direction: on AE3 you'll use source 10.129.0.0/16, on AE5 you need to set that as destination. On the download you are only able to set a destination interface, not subnet, so you'll need to ensure your QoS policy only triggers for that subnet and then apply a class (ie. 😎 thats not used for any other subnet so you dont limit download for other networks   hope that makes sense ... View more

from a connectivity bottleneck perspective it makes sense to spread connections to both collectors by setting one group to prefer collector1 and the other collector2 As you mention this does not 'improve' overall logging rate when you have redundancy enabled as the collectors will be writing logs amongst themselves so your top ingestion rate is halved on each collector. I do recommend distributing inbound connections so any peaks can be distributed and wont congest a single collector  distributing the connections should lead to slightly better performance/resilience as each collector has less inbound logs to process so has more cycles to account for redistribution ... View more

Have you tried the 'export or push device config bundle' to put the config on the new VM or installing from scratch? The config bundle will bundle all the config parts and push it in one go which will prevent any dependencies from tripping you up ... View more

@nikoolayy1 ooh that's right they JUST added user-ip mapping to CIE    ... View more

deepest apologies @gpaybins , you may have missed the email address that you need to reach out to in my reply certification AT paloaltonetworks.com ... View more