About rdonohoe23

Hi Mate,  you would need to check the filtered global counters.. Good article on same below  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClUyCAK MTU, replay attack issue or possible environmental issue with the esxi host or networking i suspect.    regards Rob  ... View more

Hi Mate,  Export the device state from the PA-220 and import and load through the CLI to the PA-400 series, that will have the merged configuration from Panorama. Make sure Panorama is running 10.1.x if adding in a PA-440. Connect the PA-440 to Panorama (point towards and add in auth key). Remove the PA-220 from the templates and device groups, and check the box for the PA-400 series. If mission critical network I would look for a maintenance window.  // Import device state (firewall only) Import the device state information that was exported using the Export device state option. This includes the current running config, Panorama templates, and shared policies. If the device is a Global Protect Portal, the export includes the Certificate Authority (CA) information and the list of satellite devices and their authentication information. //   https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRcCAK     best regards Rob  ... View more

Hi Vishnu,    You enable log forwarding on the policies and you can list two syslog servers on the same log forwarding profile. In regards to bulk changes you can use Expedition , which easily allows multi rule edits. If expedition is not possible to be deployed you can use another API tool can PAN configurator to make changes on thousands of rules quick style.    https://live.paloaltonetworks.com/t5/api-articles/pan-configurator-scripting-library-and-utilities/ta-p/52163 https://live.paloaltonetworks.com/t5/expedition/ct-p/migration_tool     cheers   Rob  ... View more

Hi Hussain,    Set the policy to only look at unknown users. Its set to any by default.    cheers Rob  ... View more

Hi Kirubakaran, Good topic to raise. I have taken a few screenshots of an approach I would take. I use Cortex XDR Advanced Endpoint Protection so was unable to check we dont get the HIP log and alert if Crowdsrike was installed. But if you use the details below and test yourself. If not getting expected results, it may need a TAC case.    Good link below that looks at using HIP checks when multiple OS's connecting to the same portals and gateways. I wrote up a few years ago under a different logon...  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClTnCAK     create hip objects. Be basic and build layers. Create objects to just ID the OS.       Build up the HIP profiles. the setup below will check if Crowdstrike is NOT installed on macbook and windows only and not ios devices. It also checks if windows defender is installed on windows pc's only.     Handy report below. Set the time frame accordingly and ideally link this up in a report group , then email scheduler to get the reports emailed out on a schedule.     The report configured above looks at the crowdstrike check only. We can traceback user and device from the report.         The screenshot above notifies the user if the check is matched / they dont have Crowdstrike installed.          hope that helps,    Rob  ... View more

DSL Dan,    sorry about the delay, was under a different login to the support portal.    hope you and PAN Ireland are well,    Rob  ... View more

Thanks Jeremy,    Yea all slow path if using the shared gateway which is resource heavy of course. Running into a few scenarios where this is a surprise to customers and alteration of the topology needed. We really need this detailed in a KB article if at all possible or mentioned on the tech docs as an fyi. It should IMO be included on the details of the external zone at the link below https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/virtual-systems/communication-between-virtual-systems/inter-vsys-traffic-that-remains-within-the-firewall/external-zone.html cheers Rob  ... View more

HI Mick,  In Panorama creating a shared custom region in a device group, doesn't reflect that option in a template gateway on the same device. Tried it with everything up to a shared object and over-riding stack. Also added in long and latitude as a shot in the dark.  The object I created could only be used in policies in any device group (once shared) May be specific to the version running and need to go to the beta forum, But may be common among all versions on panorama, re: can't select custom region in priority list for a gateway.  If can do it on the device should be able to have option on panorama,  cheers   Rob    ... View more

Hi Frederik,    We can't link an auth profile based on source IP. You could just use radius (MFA) at the sites you want and ldap at the one site you need as the auth profile on that sites gateway (assuming all sites have a gateway, with one central portal issuing the list of gateways that have ldap or radius (mfa) as the auth profile) . By default they will try connect to the lowest average ping reply from each gateway.  We have regions we can use, but can only specify different countries as priorities, we can't use custom regions in gateway selection priorities.    cheers   Rob       ... View more