About JoeAndreini

What version was upgraded from?  are both ends running 8.1.1?  Ho woften is adjacency flapping?   Check the BFD configuration - The default settings changed in 8.1. I had an instance where one side was upgraded and the other was not, and OSPF would come up until the BFD timers expired, then flap with similar messages. ... View more

Did you try setting duplex auto on cisco or duplex full on palo alto?   IIRC it must be auto or not on both sides. ... View more

Append  "&vsys={vsys_name}" to your request to target a specific vsys   This should work for any op command in a multi-vsys system   in your example: https://<IP_address>/api/?type=op&cmd=<SOME_COMMAND_HERE>&key=<API_KEY>&vsys=vsys1 ... View more

Maybe the far end does not have the hardware to support encryption?  Just a guess at one possible reason.   I once had a tunnel to Verizon Wireless for an M2M solution and they specified GRE, would not or could not do IPSEC. ... View more

That information is not written to a log file, as far as I know.   As a workaround, you may be able to define custom applications that identify the different versions from header information, and report on the use of those... ... View more

There appears to be a syntax error in your request, as you have a hanging ")" after Donkey.   I do not know exactly what is wrong, but my guess is it is related to that one or the prior one, maybe it should be text('Donkey') instead of text(), 'Donkey' ... View more

With the topology in the diagram, you would need link and path monitoring to force a failover in the event of a router failure (internal or external)   Your proposed physical links could remove that requirement, given you have enough interfaces to support it.   I do not know offhand why PAN suggests this topology over your proposal. ... View more

or use scripting-mode : set cli scripting-mode on   I never remember this exact command and often just paste 20 lines at a time rather than google it.. ... View more

I've done this two ways, depending on how many times it will need to be done.   The way i've done it when tehre are many firewalls or device groups to update is via scripting and teh XML API - I pull the policies with powershell, iterate through the policies adding the profiles or profile group, then push them back to teh firewall or panorama.  it's pretty quick.   If there is only one or two to do: log into the CLI issue the command "set cli config-output-format set" so that when you view the configuration it give set commands enter edit mode "show vsys vsys1 rulebase security | match 'action allow'" - this should give you a "list" of your rules, copy that to a text editor, so you can repalce "action allow" with 'profile-setting group "<your profile group>"' or the appropriate command to set the profile(s) you want. paste the commands back into the firewall - be aware the buffer is relatively small, take 10-15 lines at a time ... View more

You should be able to append   "&vsys={vsys_name}" to your request to target a specific vsys   This should work for any op command in a multi-vsys system ... View more