• When the memory allocated is less than 4.5GB, you cannot upgrade the firewall. The following error message displays: Failed to install 9.0.0 with the following error: VM-50 in 9.0.0 requires 5.5GB memory, VM-50 Lite requires 4.5GB memory.Please configure this VM with enough memory before upgrading.
• If the memory allocation is more than 4.5GB but less than the licensed capacity requirement for the model, it will default to the capacity associated with the VM-50.
  The System log message System capacity adjusted to VM-50 capacity due to insufficient memory for VM-<xxx> license, indicates that you must allocate the additional memory required for licensed capacity for the firewall model.

1. You create a parent device group DG-A and a child device group DG-B.
2. You create address objects called AddressObjA in the Shared, DG-A and DG-B device groups and add AddressObjA to a Security policy rule under DG-A and DG-B.
3. Later, you change the AddressObjA name in the Shared device group to AddressObjB.

• Define URL exceptions for specific web sites—

  admin# set profiles url-filtering <url_filtering_profile_name> mlav-category-exception

• Configuration settings for each inline ML model—

  admin# set profiles url-filtering <url_filtering_profile_name> mlav-engine-urlbased-enabled

• Panorama is running PAN-OS 10.2 and managed firewalls are downgraded from PAN-OS 10.2 to PAN-OS 10.1.4 or earlier PAN-OS release.
• Panorama is upgraded from PAN-OS 10.1 to PAN-OS 10.2 and managed firewalls are running PAN-OS 10.1.4 or earlier PAN-OS 10.1 release.

1. Downgrade your managed firewall to PAN-OS 9.1
2. Log in to the firewall web interface and view the Tasks to verify all auto commits related to the downgrade have completed successfully.
3. Log in to the Panorama web interface and CommitCommit and Push to your managed firewall downgraded to PAN-OS 9.1.

Per pan-task Netx statisticsCounter Name    1   2   3   4   5   6   Total---------------------------------------------ready_dvf       2   0   0   0   0   0     2

Per pan-task Netx statisticsCounter Name    1   2   3   4   5   6   Total---------------------------------------------ready_dvf       1   1   0   0   0   0     2

• Modify the PAN-DB Server IP address on the managed firewall.
  1. On the web interface, delete the PAN-DB Server IP address (DeviceSetupContent IDURL Filtering settings).
  2. Commit your changes.
  3. Add the new M-500 Eth1/1 IP PAN-DB IP address.
  4. Commit your changes.
• Restart the firewall (devsrvr) process.
  1. Log in to the firewall CLI.
  2. Restart the devsrvr process: debug software restart process device-server

• Initiate a Commit to Panorama operation followed by a Push to Devices operation for the modified device group and template configurations.
• Manually select the devices that belong to the modified device group and template configurations.

• Switch to the firewall Context on the Panorama management server.
• Commit changes when a dynamic update is being installed.
• Generate a custom report when a dynamic update is being installed.
• Generate custom reports during a commit.

• You did not configure a worker list to add at least one worker node to the cluster. (In a two-node cluster, both nodes are controller nodes configured as an HA pair. Adding a worker node would make the cluster a three-node cluster.)
• You did not configure a service advertisement (either by enabling or not enabling advertising DNS service on the controller nodes).

• After you import the two-node cluster into Panorama, push the configuration from Panorama to the cluster. After the push succeeds, Panorama reports that the controller nodes are in sync.
• Configure a worker list on the cluster controller:

  admin@wf500(active-controller)# set
  deviceconfig cluster mode controller worker-list <worker-ip-address>

  (<worker-ip-address> is the IP address of the worker node you are adding to the cluster.) This creates a three-node cluster. After you import the cluster into Panorama, Panorama reports that the controller nodes are in sync. When you want the cluster to have only two nodes, use a different workaround.
• Configure service advertisement on the local CLI of the cluster controller and then import the configuration into Panorama. The service advertisement can advertise that DNS is or is not enabled.

  admin@wf500(active-controller)# set
  deviceconfig cluster mode controller service-advertisement dns-service
  enabled
  yes

  or

  admin@wf500(active-controller)# set
  deviceconfig cluster mode controller service-advertisement dns-service
  enabled
  no

  Both commands result in Panorama reporting that the controller nodes are in sync.