Good day Team, Trust you are well, We need your help with your expertise please. We are trying to establish a second EBGP neighborship with Azure Express Route for redundancy and we are failing to form that establishment. There are two Express Route provisioned and the primary has already been established with the same configuration as the secondary except the IP addresses. We see that when it does enter the open message to establishment / Neighbour it does and then quickly leave the establishment as a forming like some sort of like a flap but within seconds of the establishment . In the packet capture we see the open message sent from the firewall to the azure vr / device and some packet resets below screenshots. We like to know if there is any known palo alto bug which is causing this weird issue , the output below shows the code 2 for the bgp error which does not make sense and the AS number is acceptable and forms the establishment. The hold down timers and configuration are correct for BGP. Your help is much appreciated in a solution.

I'm new to Prisma Access and can't seem to figure out how to block IPs, EDLs, etc from even attempting to authenticate to Prisma Access. If it were on a firewall, the security policy that allows or blocks traffic to the portal/gateway could block it, but it seems that none of the security policy should apply until after authentication. There must be a way of preventing the brute force attempts. What am I missing? Thank you!

Good day Team, Trust you are well! I have a query for forwarding Global Protect SAML authentication logs to a siem/syslog.We have multiple firewalls that is managed by a panorama .The Panorama acts a log collector and management that forwards these logs to the siem/syslog server.There is a syslog configruation and profile on the panorama that sending the logs for traffic , auth , data, decryption , threat , tunnel url & wildfire that is filtered for "All Logs" The logs are seen on the siem/syslog server except the global protect client authentication that uses Azure SAML. We can see idp global protect auth logs in Monitor and System logs but is not forwarding this specific log. The Global protect secruity rule and amongst the others have the fowarding logs to the profile is enabled. Is there something we missing ? Regards ZeroTrust