About dreputi

Hello Roh, From the spec sheet of 7050 and also the output of 'show system state | match policy' with latest panos version it shows 40,000 rules only. Click on 'show more' under 7050 Product Selection cfg.general.max-policy-rule: 40000 Hope that helps. -Dileep ... View more

Hello Nathan, It could be different things based on your config: -passwords -custom logos -certificates 'It will show begin cert, and end cert' -custom response pages Licenses will not appear in the running configuration. If you want to export a running configuration you can export by GUI:Device>Operations>Export named configuration snapshot>running-config.xml. Let me know if you have any questions. Please mark the answers as answered or helpful as applicable. Regards, Dileep ... View more

Hi Satish, I agree with with Steven. Currently it is not possible to choose the import/export config options in admin role. You can submit a feature request through your SE so that this can be implemented in future versions. With the current features, the best you could do is to create two roles one with access to 'setup' and other without so that you can assign it to an admin if he needs setup access or not. Let us know if it helps. -Dileep ... View more

Hello Yu, You cannot use a layer-3 or a sub-interface interface neither in multiple vsys nor multiple VRs. So an interface can only be part of one VR and one Vsys, however the VR can be shared among multiple Vsyes. -Dileep ... View more

Hello Mandar, Check the following CLI output: > show global-protect-satellite current-gateway It will tell details of tunnel like: Tunnel Monitor Enabled : Yes Tunnel Monitor Interval : 3 seconds Tunnel Monitor Action : fail-over Tunnel Monitor Threshold : 5 attempts Tunnel Monitor Source : 10.11.12.12 Tunnel Monitor Destination : 172.16.1.254 Tunnel Monitor Status : Up Make sure you have proper connectivity between the above source and destination, also if there are any route flaps as you mentioned it is intermittent. Useful resources you may refer: Large Scale VPN (LSVPN) Deployment Guide Useful commands from this doc: Gateway/Portal show global-protect-gateway gateway type satellite- To view the gateway configuration summary. show global-protect-gateway flow-site-to-site- To view the established tunnel state. show global-protect-gateway flow-site-to-site tunnel-id <number> or show global-protect-gateway flow-site-to-site name <tunnel name > - To view the established tunnel details. You can view the tunnel-id using the command - show globalprotect-gateway flow-site-to-site show global-protect-gateway current-satellite- To view the details of current satellite. Satellite request global-protect-satellite get-gateway-config satellite <name> gateway-address <ip_address>- To fetch the configuration from the gateway if any configuration changes are made to the gateway. By default, the gateway configuration is refreshed every 2 hrs. request global-protect-satellite get-portal-config satellite <name>- To fetch the configuration from portal. By default, the gateway configuration is refreshed every 24 hrs. test global-protect-satellite gateway-connect gateway-address <IP address> method activation satellite <name>- Trigger GlobalProtect satellite connects to gateways. Hope that gives some info. Regards, Dileep ... View more

Hello Satish, Yes you are right, the finest you can do would be whether to allow/deny access to 'setup' tab but not more granular than that. Hope that helps. Regards, Dileep ... View more

Hello Slawek, The meta information (release notes, dates) etc are reported by update server and filled in if device has direct connectivity to update server. There is no mechanism to download (encrypted version) from update server and upload to panos- Not sure if this behavior has changed recently, most likely it has not changed. I believe you are not alone in experiencing this, it is expected behavior(as of now) if we are uploading manually then it will not show the meta-data. In fact I was able to replicate it as you can see in my previous comment. You can follow up these with your case: 1. Reason for automatic updates failing?- if they go fine you wouldn't see this issue. 2. If there is a way that manual uploads also show meta-data. Hope that helps. Regards, Dileep ... View more

Hello Mike, I haven't found any feature request for folders. May be you can contact your SE to submit a request. -Dileep ... View more

Hello SLawek, I see this usually if the content is updated manually and/or when the firewall doesn't have connectivity to the updates server since that is where it will pull this information from. Infact I just tested it with manual upload, it gives me same info. Please check if any of these are matching with your case. Regards, Dileep ... View more

Hello Tigran, You are right you will have to export the config from GUI:Device>Setup>Operations>Export Named config/Export config version/Export Device State. Device state will be very useful if you have the device connected to Panorama as it will have all the config including those pushed from panorama. Here is a document you can follow to replace a firewall: How to Setup a RMA Replacement Firewall As such there is no backup button. You can name a config from GUI: Device>Setup>Operations>Save named configuration snapshot and type a name, which you can export using above command. Hope that helps. Regards, Dileep ... View more

Hi, Few things you can check are: -Make sure in the 'download & install' section there is no 'Threshold' value configured. By default it will be blank but if it was configured, the firewall will see if the update is atleast those many hours old, if not it will not install it. -Follow ms.log and look for the time stamp at which your update is supposed to occur, it can give more details on 'threshold' or any communication issues etc. >less mp-log ms.log -You can also look at paninstaller.log, at the very bottom check which version it is showing. If it shows an older version but the GUI shows latest is installed, it actually may not be installed. You can try to revert to previous version first and upgrade again. > less mp-log paninstaller_content.log -There could be communication issues/server issues. -Corrupt files from past.(Uncommon) -Also issues with normal commit due to config like Darren mentioned above. Hope it helps a little. Regards, Dileep ... View more

Hello Panlst, The answer to your question is 'No' under your conditions. In general, following are the options: 1. Use a certificate signed by 3rd party vendor like Verisign, GoDaddy, etc. This is best solution as this cert will be trusted by all the browsers irrespective of the device. 2. Use a PAN self signed certificate or domain generated sub-ordinate certificate. Install its certificate authority on the client browsers. Though technically this will work, practically it is very difficult to implement this since typically you wouldn't be knowing which device the user will be using. So not scalable. Hope it helps. Regards, Dileep ... View more

Hello Santonic, The session IDs will be different. The control channel will be 'Parent Session' and the data channel will be 'child session'. But they work together ie the child session will be (predicted and converted to Active Flow) based on the parent session. Here is a sample output of child session: > show session id 685 Session 685    <<<<<<<<<<<<<<<< Child Session ID c2s flow: source: 192.168.23.215 [trust-L3] dst: 10.66.22.169 proto: 6 sport: 64047 dport: 24492 state: ACTIVE type: FLOW src user: unknown dst user: unknown s2c flow: source: 10.66.22.169 [dmz-L3] dst: 10.66.22.23 proto: 6 sport: 24492 dport: 2671 state: ACTIVE type: FLOW src user: unknown dst user: unknown start time : Sat Mar 29 06:51:52 2014 timeout : 30 sec time to live : 24 sec total byte count(c2s) : 25293 total byte count(s2c) : 69890 layer7 packet count(c2s) : 416 layer7 packet count(s2c) : 461 vsys : vsys1 application : ftp-data rule : trust-2-dmz session to be logged at end : True session in session ager : True session synced from HA peer : False address/port translation : source + destination nat-rule : nat-trust-2-dmz(vsys1) layer7 processing : completed URL filtering enabled : False session via prediction : True use parent's policy : True parent session : 683    <<<<<<<<<<<<<<<<<<<<<<<<< Parent session ID refresh parent session : True session via syn-cookies : False session terminated on host : False session traverses tunnel : False captive portal session : False ingress interface : ethernet1/4 egress interface : ethernet1/5 Let us know if that helps and if you have any questions. Regards, Dileep ... View more

Yes, it should work even if you have a drop rule. This is because the ALG is tracking the session based on its prediction. Like I mentioned earlier, ALG opens a predict session on for the second connection and when it receives that traffic, PAN will match the traffic to PRED session and convert it to ACTIVE session. Let us know if you have any questions. ... View more