I'm receiving a VM-100 license for lab/nfr use. If I'm lucky I'll also add a Panorama VM. I'd like tips re. running on ESXi workable hardware (doesn't necessarily need to be on VMware HCL) in a home office, or basement hovel setting. This is a PCNSE renewal, PCNSC study, Pandemic project. Thanks in

Hi I have a Firewall currently setup in a Panorama Device Group. I now want to to manage a new Firewall that has a similar set of rules (not a HA) so I want to put it in the same Device Group, so the rules are synced going forward. My question is what happens to the rules on the 2nd Firewall when

I'm new to Prisma Access and can't seem to figure out how to block IPs, EDLs, etc from even attempting to authenticate to Prisma Access. If it were on a firewall, the security policy that allows or blocks traffic to the portal/gateway could block it, but it seems that none of the security policy sho

I never noticed this before, what does "dropped privs to tcpdump" mean and does it mean I'm not capturing the traffic I want to see? > tcpdump filter "host 1.1.1.1" Press Ctrl-C to stop capturing dropped privs to tcpdump tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 262144 b

ECMP - limitations - Path monitoring Next - Routes to next -VR ECMP Hello community, how are you doing, I hope you are well. A doubt, I saw, I can't find now the post, if it was on live, on reddit or somewhere else but I understand that for an ECMP environment. Example: -Route to 0.0.0.0.0/0 by et

Hello masters, how is everything going? I hope all is well. Does anyone have an idea of this issue and if from any version changes, I'm trying in 10.1.X and nothing. The issue is that I have a custom profile for a user that can only unlock other users that have been locked out especially Global Pr

RMA of HA connected to Panorama - PAN-OS 9.1.x Panorama 10.1.x Hi, I hope everything is ok. I have a question regarding the RMA issue. I have a HA, connected to Panorama, where we have to perform the RMA of one of the firewalls. I have reviewed some links of the process that still is not quite cl

Implementing SD-WAN for the first time. The config commits ok and pushes to hub firewalls ok, but on branches I get that generic error "Failed to autogenerate SDWAN configuration". I looked in configd and I see: Error: pan_cfg_pushtpl_autogen_config_merge(pan_cfg_templates.c:7060): Zones node or z

Best option for a Vwire with tagged and untagged traffic. Hello guys, how are you today ? I hope everthing OK thank you very much as always for the collaboration. What is the best option when it comes to setting up a Vwire environment with tagged and untagged traffic, ie. VLANS=====1 Untagged, vla

Doubt RMA process - new firewall registration Hello, good afternoon. I hope you are doing great, thanks for the support, collaboration and good vibes. I have a doubt, I have always had RMA of parts, fans, disks, among others. Now I have a doubt, the link indicates or catalogs the firewall in Spa

During an upgrade from PAN-OS 10.2.3 to PAN-OS 10.2.12-h2 we saw the upgraded firewall go non-functional due to NAT Oversubscription mismatch. I have seen this when upgrading between major versions, but not in such a minor change. Is it expected to have a change like this when upgrading maintenanc

We had a client who had their NAT policies targeted to one member of an Active/Passive HA cluster --- for some reason. And we did not notice this until we failed over and the network stopped working. The config showed as in sync between the two peers. I've checked and cannot find documentation th

Hello how are everyone ? I hope it's ok. As always, thank you for your time, tips, collaboration and good vibes. Has anyone made a migration from a Meraki-MX65 to PA? I have made some several other migrations from other vendors, but Meraki has not affected me, in Expedition there is no declared

I have a Panorama in Panorama mode on ESX. I have 2 collectors that collect logs from firewalls. The collectors are not set to forward logs to Panorama, that I know of, at least I don't see where this would be set, anyway. When I look at Panorama, I see current traffic logs. Is Panorama pulling th

I want to block inbound traffic coming from proxies and VPN services, i.e. services such as NordVPN and Hoxx. I barely knew this existed, but there is a region code "A1" for Anonymous Proxy. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClFFCA0 So i created a rule, from

Hello PANGURUS, The X-Forwarded-For Headers option has already been enabled and it has been set to Enabled for security policy, but the information is not visible. Something else has to be enabled in the device configuration or in the load balancer? I followed this kb. https://docs.paloaltonetwork

I switched my lab box to the advanced routing engine (ARE), and now I can't run the CLI command "test routing fib-lookup" because it wants a virtual router in the argument, but in ARE there are only logical routers now. Does that mean i can't use the command anymore? There's no way to test lookups

Global couter historical blockages or drops due to asymmetric traffic. Hello, good evening, as always thanks for the collaboration. Is it possible to review the history, not what changed in the last hour, minutes or seconds, but the history of the last 6 or 8 hours ? Is it possible ? If I run a

Hello, thank you community, how are you, I hope you are well. I have a huge doubt. We updated Panorama from 9.1 to 10.1.X The firewalls are still at 9.1.1 Now I get an error that: Device Admin Role for the role based admin has not been defined Now I follow the instructions in this KB: https://

Palo Alto Global Protect Client - Upgrade 5.x to 6.X. Hello, how are you doing, I hope well. I have a question, such as in versions 5.0, 5.1 and 5.2, is the update from 5.1 or 5.2 to 6.X completely transparent? As for configuration, performance etc? Can I activate the version and tell users to up

We have a client who does not have a HA2 link and we expected the fail over to not be smooth because the sessions are not being synced, but we found that HA state information was also not being synced. According to the documentation, this should happen over HA1, which is functional. What am I miss

Hi, looking for help. We have a fleet of several hundreds Windows 10/11 devices and we have recently updated Global Protect to v. 6.2.4. About 10% of the devices are unable to connect with the following error message: We have been plagued by this issue even with previous versions and Palo Alto Sup

HA Condition - Link Monitor Recovery - Time to retake Active Link Monitor role Hello Community, how is everything going, I hope it's going well. I have the following questions regarding HA. Details of the environment. Active - Passive A/P Main - PA-52XX-01-HA - Priority 50 Secondary - PA-52XX-02-H

Jumbo L2 frames ? MTU only L3 adjust - Inherits L2/Vwire Hi, how are you doing, I hope you are doing well. I have seen that at config level there is little or nothing about Jumbo Frames, so the truth is that I have a big doubt. According to the docs the first step is to manually enable global Jumb

USER-ID log from VPN Cisco concentrator Dear community, how is everything going ? Have you ever had to do the following? We have to integrate a Cisco ASA, with Palo Alto, so that the PA receives from a Cisco ASA and/or Cisco ISE the users to be able to have mapper with USER-ID the users that conn

Hello community and master reaper I hope you are well. I have had to configure Global Protect on several occasions but I have a question that I am being asked in this case: Is it possible in S.O windows to use the Always On, filtering that only connects to GP when it detects the connection in an E

IPSEC VPN - Palo Alto to Fortigate ( Forti behind a NAT ) Hello community, as always thank you for your collaboration. I understand that it is feasible, I have not had to do it, but I understand that it is possible to do the following. Scenario: -Palo Alto Firewall Static Public IP directly connec

Active Active Vwire IPS - PA Hello, how are you, as always thanks for the support. A client wants to remove their IPS tipping point and place their PA 1410 there, which only uses 3 L3 interfaces, due to load issues, performance everything is fine, it uses hopefully 1 to 6% of the load. Currently

Palo Alto Web-GUI UI Admin - Azure AD Hello community, thank you as always for your time and collaboration. I have a question, some client is asking me and asking if Azure-AD can be used for authentication of administration access to the firewall... Now with Global Protect we have configured it,

Our client uses Cortex XDR and I would recommend turning on Enhanced Application Logs, but want to make sure that this would not change the formatting for the logs exported through syalog. Thanks!