About gswcowboy

You would only need to download the 6.0.0 base image and then proceed with a download and install of 6.0.3 soon thereafter. If you're seeing issues on your config, I usually run the following upon a reboot of a major PANOS. Upon completion of the reboot and autocom job has completed, go into configure mode of your device and perform the following. This may assist with any possible anomalies that crop up with the config xml file upon a major upgrade. admin@Lab11-PA3020> configure Entering configuration mode [edit] admin@Lab11-PA3020# commit force ....55%99%.....100% Configuration committed successfully admin@Lab11-PA3020# exit Exiting configuration mode ... View more

Hulk may have hit the head on the nail w/ respect to the PBF rule.      ... View more

if pan is not getting the s2c traffic back in return, perhaps vendor can provide logs/data(pcaps) related to the ike initiated traffic from your end to help w/ the analysis? ... View more

you could enable packet-diag filters and perhaps flow basic and pcaps to give some more granular insight(are we dropping packets, etc) but would err in the side of caution and do this during off peak hours. ... View more

confirm NAT-T is required and enabled. here's an excerpt log from another vendor where it wasn't supported. confirm if it's supported on their end. VPN IKE NAT Discovery : Peer IPSec Security Gateway doesn't support VPN NAT Traversal ... View more

Probably getting condensed version but you can make it more granular by expanding the dates as shown below. I believe default behavior is 7 days admin@PA200>scp export stats-dump start-time equal 2012/08/01@00:00:00 end-time equal2012/08/22@00:00:00 to user@remotehost:/statsdump_123.tar.gz ... View more

172.17.1.5 is initiating ike session to 199.169.208.244 and it's hitting sec and nat policy as defined. The following below indicates the lack of a response from the destination peer IP as it probably doesn't have GW (ike/ipsec)  configured for the initiating host in question.    layer7 packet count(c2s)      : 23853         layer7 packet count(s2c)      : 0 ... View more

there's a multitude of docs on kb. here's some to get you started How to Configure IPSEC VPN Site-to-Site IPSec VPN between Palo Alto Networks Firewall and Adtran (or IBM) Device Unable to Pass Traffic Tips for Configuring a Juniper SRX IPSEC VPN Tunnel Terminating on a PAN How to Configure an IPSEC VPN with Route and Tunnel Configuration from CLI The IPSEC Tunnel Comes Up But Hosts Behind Peer Are Not Reachable ... View more

something more granular but be sure to confirm filter is enabled and to clear the debugging when you're done. This can be intrusive debugging so doing it carefully is highly recommended Packet Capture, Debug Flow-basic and Counter Commands ... View more

Awaiting official release     ... View more

Possible Emergency update. Will update thread accordingly. ... View more

Coverage will be available with release of Content version 433 (tomorrow evening) -Renato ... View more

PANOS software updates (minor iterations) are generally released every 4-6 weeks but could be longer depending on the changes needing to be implemented. ... View more

We'd need to investigate root cause for the resource utilization on your DCs if that were the case. I'd recommend opening a case to get started. ... View more

output data from following commands: >show jobs all log output for the ports in question from the following command >less dp-log brdagent.log ... View more

yes, assign a different IP from your IP block and assign it to the loopback interface. ... View more

Also, it would also assist by requesting your Sales SE/Reseller to submit a feature request to Product Management for this feature via Request ID 2423 . ... View more

can you at least provide us output for following command? admin@TDC-P-FW01> show user group name   "cn=domain admins,cn=users,dc=pantac2003,dc=com"   cn=domain admins,cn=users,dc=pantac2003,dc=com   "pantac2003\domain admins"                         pantac2003\domain admins   <value>                                            Show group's members admin@TDC-P-FW01> show user group name "cn=domain admins,cn=users,dc=pantac2003,dc=com" short name:  pantac2003\domain admins source type: ldap source:      test ... View more

Create a loopback interface using a secondary public IP address for your 2nd portal ... View more

Is mgmtsrvr cpu/memory utilization high during UI navigation? Is IO spiking at high values as well? If so, are you logging both session start and end? ... View more