About LCMember20111

Thanks @AlexanderAstardzhiev. I appreciate the feedback. ... View more

Thanks @AlexanderAstardzhiev for the deep dive explanation.   My situation is very simple -   1. This pair of 3220's sole purpose is terminating site to site VPN tunnels. 2. Each "partner" has their own tunnel.x interface and zone specific to them. 3. I route the remote side traffic into the related tunnel.x interface in the VR 4. There is no hide-nat (again, these 3220's won't be used for generic internet access)   Based on your response, I shouldn't need the NoNat, correct? And you are correct in  how the ASA treats traffic and the need for the NoNat.   Thanks in advance ... View more

@reaper -    If I may bump this for a QQ -   If I am converting from Cisco ASA s2s VPNs to Palo's, do I need to configure the "nonat" like I have on the ASA? Based on your above response, that answer is no? Is this accurate?   Thanks in advance, ... View more

You use the group filter for this.   Name all the groups with a similar name, like, app-palo-groupname, then in the filter, specify as the group include, cn=app-palo-* .   It works great.   ... View more

Another request -    Within Panorama---Managed Devices---Summary   You tag a device or groups of devices.   Is it possible to send that in the syslog to Splunk? Would be nice to report on that as well for certain compliance requirements, such as LEAP. ... View more

Commit Description -    Is it possible to send the commit description in the syslog like the audit comment? This would be nice to be able to report on in Splunk.   Thanks     ... View more