14. Palo Alto Firewall - Packet Capture

In this video you will see how to do packet capture on Palo Alto Firewall.
This is a step by step instruction as usual.

I suppose these links will be useful for you as well:

[davidr.flores]

Thanks Rafis, great video, nice and easy explanation. Best

[ferdinandlamer]

Hi bro great video as always. Can you please help put up a tutorial video on how to remove Panorama from my network? Current setup is that I have a Panorama and this Panorama manages 2 firewalls that are in HA. I want to remove the Panorama and just access the firewalls directly. Appreciate your help and thank you

[RohitSharma-burj]

Please make vedios on packet capture with global counters

[minit]

When you say, it is system heavy, how big is the risk to halter a production enviroment ?

[psspundari]

Hi Rafis
After we see those files in wireshark, how can we find error .

[RakeshSharma-bxpj]

do we have any demo website for palo alto . like fortigate firewall. ?

[vitaliypak]

Thanks for the video but is it possible to solely use the "Monitor" tab (without creating/managing CUSTOM REPORTS) to only show UNIQUE sessions (date/timestamps excluded) as opposed to all the (REDUNDANT) sessions/logs? In other words, perform a DISCOVERY to identify the unique appIDs/destination-ports and source/destination IPs all within the "Monitor" tab (without needing to create custom reports) and without the numerous pages of sessions/logs?

Oftentimes, there's countless pages of logs/sessions where the source/destination zones/IPs & destination-ports/appIDs + actions remain the same but the timestamp & packets/bytes-sent is different but I just want to see ALL *UNIQUE* sessions (based on source/destination in a single log-entry as opposed to thousands similar sessions with primarily different timestamps (and various # packets/bytes). I just want to see within the "Monitoring" tab all UNIQUE source/destination IPs & ports/appIDs in a single log-entry as opposed to countless similar sessions occurring at different timeframes (and # & size of packets changing which I don't care about). This would greatly simplify the DISCOVERY process (for data-flow/policy identification purposes to figure out what source/destination zones/IPs & services[ports/appIDs] are needed as opposed to seeing COUNTLESS logs with repeated sessions.