Groups Feed

Welcome to our group PANgurus Group! A space for us to connect and share with each other. Start by posting your thoughts, sharing media, or creating a poll.

I’m planning to take the PCNSE and not sure where to begin. Any tips or recommended resources to get started?

Anyone with exp in PAN-OS SD-WAN without panorama for VPN S2S Dual ISP ?

Hi PANGURUS-community, how's it going ?

Does anyone have operational functional experience of pan-os sdwan ( firewall sdwan without panorama and without cloudgenix appliances ) deployments operating and running sites with two ISPs for IPSEC S2S VPN connections.

Today we have operating only pan-os sdwan for internet outbound, with 2 unified links, operating well, however with limitations but it works and good well.

Now thinking of moving to VPN S2S using pan-os sdwan scheme, anyone has experience of deployment in their environments ? if it operates correctly ? Points, tips, points to focus on, recommendations, headaches, etc. If you have had any unexpected problems, what has been your feedback, your experience operating between HQ to VPN S2S branches of at least 5, 10 or more pan-os sites between your PANW firewalls of branches against the HQ.

Hi master reaper, thanks as always for your time, collaboration and patience

I have the following issue, I am reviewing documentation, validating, everything, but I have big doubts, at cisco CCNA level I understand well RIP.

I am migrating some Fortigate to PANW, everything excellent, everything good, nothing new, everything OK expedition,

I have been debugging for hours and days but everything is fine.

But RIP, I have huge doubts, it is a simple config, but IN Palo Alto Networks filter example does not have and also is a config so simple that I am embarrassed, someone can support me to move it from fortigate to PANW, I have clear that I must apply the redistribution profile for what is connected and static, but look is just this, maybe I'm getting too complicated, obviously has slight adjustments, but the base is the same: config router rip

config distribute-list

Globalprotect Azure-AD SAMLIntegration - Policy Based Groups Azure-AD

Hello PanGurus! , how's it going? I hope it's going well.

For licensing issues Azure AD only has Azure-ad then at the enterprise app level I can only assign users, but I have my doubt operates well with groups, ie in the Assign part, I can assign Groups and not just users to authenticate without having problems with GP? at the level of the enterprise app with Azure-AD SAML Globalprotect PANW.

Is it feasible to make group based policies, ie:

GP source zone - destination DMZ01 Azure Source Group: IT01

I.e. Azure Group-AD IT01@contoso.com , another with SEC01@contos.com Infra@contoso.com.

Can someone explain what it is and what the difference is between checked and unchecked?

I read this, "To enable firewall capabilities for IPv6 traffic, Edit and select IPv6 Firewalling.

The firewall ignores all IPv6-based configurations if you do not enable IPv6 firewalling. Even if you enable IPv6 traffic on an interface, you must also enable the IPv6 Firewalling option for IPv6 firewalling to function."

But it's not really registering in my head exatcly what that means in plain English.

We have a client who does not have a HA2 link and we expected the fail over to not be smooth because the sessions are not being synced, but we found that HA state information was also not being synced.

According to the documentation, this should happen over HA1, which is functional.

What am I missing?

Thank you!

During an upgrade from PAN-OS 10.2.3 to PAN-OS 10.2.12-h2 we saw the upgraded firewall go non-functional due to NAT Oversubscription mismatch.

I have seen this when upgrading between major versions, but not in such a minor change.

Is it expected to have a change like this when upgrading maintenance versions?

Hi

I have a Firewall currently setup in a Panorama Device Group.

I now want to to manage a new Firewall that has a similar set of rules (not a HA) so I want to put it in the same Device Group, so the rules are synced going forward.

My question is what happens to the rules on the 2nd Firewall when I add it to the Device Group and push the policy? Does the Device Group Rules (currently from the 1st Firewall import) get merged with the existing rules? Will duplicates get removed? Or will it overwrite the whole config?

Many thanks.