About Remo

Hi @masuo.taishi  What exactly is the error you see in CLI? Why do you think the image is corrupted? ... View more

You plan to migrate just this one azure firewall to the azure panorama or you plan to fully migrate the onprem panorama to azure? For the full migration, I still recommend to export the config and import it to the azure panorama and the job is - except for some minor changes in the config like Mgmt IP - done. Even if you only want to migrate just one it might be the easiest way like this and then delete the devicegroups and templates you do not need in azure.    What do you mean with automate the migration? You can also write a script in order to read the local config and write everything to the other panorama or use existing automation frameworks, but I think in a migration case this might be more work than export/import - depending on your special plan of the migration. ... View more

Hi @kevinospf  You need to click the gear icon at panorama settings. On the view that is opened then, you have two buttons to disable templates and/or device groups. ... View more

I don't know the algorithm that checks for the shadow rules, but if you have more than one, then it will be shown there as a list. So yes, it will show you all shadowed security policy rules in the system. ... View more

May I ask what dashboards are you talking about? XSOAR, XDR or maybe Xpanse dashboards or something completely different? ... View more

Hi @MEANUPTHAKUR95  What did you already do? Is the new panorama set up the same way as on prem? As the logs cannot be migrated, all you need to do is export the existing configuration and import it to the azure panorama. If you did this already and you have other issues with this, please give us some more details where you need help 😉 ... View more

Hi @omid.gulban  When you do a commit or validate the config prioe to a commit the firewall will show you shadowed rules:   ... View more

When I think again, it is probably even easier if you use a dedicated portal also for the personal devices. This way you have everything clearly separated and you don't have to deal with device checks. Simply use cert authentication on the domain portal and something without certs on the other ones to make sure that personal devices are not able to use the domain portal/gateway.  I hope this will help you with the implementation of this request 🙂 ... View more

You could achieve this by using a machine certificate check in the config selection criteria in portal agent settings (if your domaindevices have a corporate cerificate installed). Another possibility is to use a custom device check where you look for a specific registry key/value. After that you assign the corporate devices another globalprotect gateway than the personal devices. On one gateway then you can configure the full tunnel for the corporate devices and split tunnel for the personal devices on the other globalprotect gateway. ... View more

By default these two use different ports for the communication from the firewalls to the user-id/fsso agent, so there shouldn't be a problem with installing both on the same server. ... View more

Hi @jogyulas  There is nothing like a specific CLI command that will show you directly what you are asking for.  But in monitor tab it is actually pretty easy to filter exactly for this information. As a base filter simply add "(action eq block-continue)". In addition to that you can specify the url category or the user you want to check and if you direcrly want to see only the entries in the cache currently, then add an additional filter for time_generated with a greaterequal (geq) and the time in the past with the current time minus the timeout you configured on the firewall. The result is a view that only shows you the current entries (as long as the user clicked the continue button - otherwise unfortunately there will be many logs with action block-continue). ... at least a beginning about where to get the information you mentionned. ... View more

Sound like there is a network mismatch betwenn your and the other side. Did you check if the networks match on both sides? ... View more

No, at least no easy way. You can also export all the logs manually from the monitor tab or create a script that fetches the logs over the API and write them to a place where you can access them when you need it.  ... View more

Hi @SachinGargNTT  How long is the retention time of the existing M-100 appliance and how long is your company policy for the retention? Actually on the link you provided, the solution is already written: ----------------------------------------------- This procedure assumes you are no longer using the M-100 or M-500 appliance for device management or log collection. If you plan on using the decommissioned M-100 or M-500 appliance as a Dedicated Log Collector, a device management license is required on the M-100 or M-500 appliance. Without a device management license, you are unable to use the M-100 or M-500 as a Dedicated Log Collector. You may still access existing log data at a later date if you do not plan on using the M-100 or M-500 appliance as a Dedicated Log Collector. After you have successfully migrate to the new M-Series appliance, power on the M-100 or M-500 appliance to query and generate reports from the Panorama web interface of the decommissioned M-Series appliance. Palo Alto Networks recommends reviewing the log retention policy before decommissioning the M-100 or M-500 appliance. ----------------------------‐------------------------------- This means on your new appliance you can add the old log collector as a dedicated log collector that you use only for logqueries and not for writing new logs to it. This requires that the old appliance is still licensed otherwise you will not be able to continue to use it. Does this answer your question? ... View more