You would only need to download the 6.0.0 base image and then proceed with a download and install of 6.0.3 soon thereafter. If you're seeing issues on your config, I usually run the following upon a reboot of a major PANOS. Upon completion of the reboot and autocom job has completed, go into configure mode of your device and perform the following. This may assist with any possible anomalies that crop up with the config xml file upon a major upgrade. admin@Lab11-PA3020> configure Entering configuration mode [edit] admin@Lab11-PA3020# commit force ....55%99%.....100% Configuration committed successfully admin@Lab11-PA3020# exit Exiting configuration mode ... View more

Hulk may have hit the head on the nail w/ respect to the PBF rule.      ... View more

if pan is not getting the s2c traffic back in return, perhaps vendor can provide logs/data(pcaps) related to the ike initiated traffic from your end to help w/ the analysis? ... View more

you could enable packet-diag filters and perhaps flow basic and pcaps to give some more granular insight(are we dropping packets, etc) but would err in the side of caution and do this during off peak hours. ... View more

confirm NAT-T is required and enabled. here's an excerpt log from another vendor where it wasn't supported. confirm if it's supported on their end. VPN IKE NAT Discovery : Peer IPSec Security Gateway doesn't support VPN NAT Traversal ... View more

Probably getting condensed version but you can make it more granular by expanding the dates as shown below. I believe default behavior is 7 days admin@PA200>scp export stats-dump start-time equal 2012/08/01@00:00:00 end-time equal2012/08/22@00:00:00 to user@remotehost:/statsdump_123.tar.gz ... View more

172.17.1.5 is initiating ike session to 199.169.208.244 and it's hitting sec and nat policy as defined. The following below indicates the lack of a response from the destination peer IP as it probably doesn't have GW (ike/ipsec)  configured for the initiating host in question.    layer7 packet count(c2s)      : 23853         layer7 packet count(s2c)      : 0 ... View more

there's a multitude of docs on kb. here's some to get you started How to Configure IPSEC VPN Site-to-Site IPSec VPN between Palo Alto Networks Firewall and Adtran (or IBM) Device Unable to Pass Traffic Tips for Configuring a Juniper SRX IPSEC VPN Tunnel Terminating on a PAN How to Configure an IPSEC VPN with Route and Tunnel Configuration from CLI The IPSEC Tunnel Comes Up But Hosts Behind Peer Are Not Reachable ... View more

something more granular but be sure to confirm filter is enabled and to clear the debugging when you're done. This can be intrusive debugging so doing it carefully is highly recommended Packet Capture, Debug Flow-basic and Counter Commands ... View more

Awaiting official release     ... View more