About glynn

One of the AWS SAs blogged about this:   https://aws.amazon.com/blogs/apn/monitoring-your-palo-alto-networks-vm-series-firewall-with-a-syslog-sidecar/   I found that it lends itself well to containerization as well. ... View more

What version of PANOS are you running? If it is 9.0 or below, it will not work due to the drivers. It was fixed in PANOS 9.1:   https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PMWvCAO     ... View more

Progress at last. I've seen the initial auto-commit fail/hang before. Hangs usually sort themselves out if you give it some additional time. It might be instructive to temporarily remove the bootstrap.xml file so that all you have is the init-cfg.txt file in the config directory. That should allow the FW to bootstrap but remove any configuration weirdness from the picture. You should be able to access the CLI via SSH key authentication and then use "show jobs all" to quickly check the status of the initial autocommit. If it is successful, then you can look at your boostrap.xml file more closely.    If nothing else, you can have the TAC look at it. Since you can now access the FW, they should be able to take a peek and tell you what's going on. ... View more

Correct on the first question. The virtual FW does not have a built-in password the way the HW FW do since they can be deployed/accessed across the internet. By specifying an SSH key at deployment time, you can authenticate to the CLI and set the admin password for use when logging into the GUI. The SSH key gets inserted into the admin account so you would need to connect as "admin".   If the bootstrap fails, you should still be able to get into the CLI using SSH provided you specify an SSH key at deployment time even though admin password exists on the box.    It can take several minutes for the FW to completely boot up post-deployment. During that time, you will get prompted for a password but authentication will fail since all of the management plane processes are not yet completely up. If after 10-15 minutes, you cannot authenticate, chances are that the SSH was not formatted in a manner that the FW could accept.   If the bootstrap fails but you can get into the FW, you can see information from the bootstrap attempt with the following command:   show system bootstrap status ... View more

The management interface is set to DHCP and cannot be changed as you risk locking yourself out if you mis-type or otherwise enter incorrect information on the management interface. You _can_ tell GCP to assign a static IP to that interface so that whenever it sends a DHCP request, it always gets the same IP.   Regarding bootstrapping, you shouldn't need to tell the FW where the bucket is located. Bucket names have to be unique in the DNS namespace so it is sufficient to specify the name you gave the bucket. The FW also has to have permission to access it and the bucket has to be configured with _all_ of the required folders (config, content, license, software) so that might be worth verifying as well.   If you specify a correctly-formatted SSH key at deployment time, it should be inserted into the admin account even if bootstrapping fails. The correct format for the ssh key is "ssh-rsa <public_key> <username>".   There are some examples of Terraform deployments with bootstrapping here:   https://github.com/wwce/terraform/tree/master/gcp   Most of them create/populate the bootstrap bucket at runtime. The process is the same and they might provide a template for your development. ... View more

A couple of things I can think of to double-check:   - Are you deploying the FW to the same region as the VPC network? - Are you using separate _VPCs_ for each interface?   GCP doesn't permit you to attach multiple interfaces from the same system to the same VPC network:   https://cloud.google.com/vpc/docs/create-use-multiple-interfaces ... View more

What Azure machine size are you using to deploy the FW? With 4 data plane ports, you would need at least a DS4. Also, what do the interface icons look like in the FW GUI (red, green, grey)? ... View more

Are you using FTP or FTPS? I see both mentioned in your post. Also, when you say you see the connection in the traffic table, do you see both the control and data channels or just the control?   One thing to look at is the distribution mode on the load balancer:   https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-distribution-mode   If you are using 'None' as the distribution mode, the load balancer will use src IP, src port, dst IP, dst port, and protocol to determine the backend pool member to use. If the control channel lands on one FW and the data channel on the other, the data channel will be dropped. Changing to one of the other distribution algorithms ("src IP" or "src IP and protocol") should ensure that both land on the same FW. ... View more

Amaresh:   If you are using the Azure VPN gateway, try this KB article:   https://live.paloaltonetworks.com/t5/Integration-Articles/Configuring-IKEv2-IPsec-VPN-for-Microsoft-Azure-Environment/ta-p/60340   ... View more