1. Log in to the Google Admin console and select Device managementChrome managementUser settings.
2. In the Client Certificates section, enter the following URL pattern to Automatically Select Client Certificate for These Sites:
   {"pattern": "https://[*.]", "filter":{}}
3. Click Save. The Google Admin console deploys the policy to all devices within a few minutes.

• Modify the PAN-DB Server IP address on the managed firewall:
  1. On the web interface, delete the PAN-DB Server IP address (DeviceSetupContent IDURL Filtering settings).
  2. Commit your changes.
  3. Add the new M-500 Eth1/1 IP PAN-DB IP address.
  4. Commit your changes.
• Restart the firewall (devsrvr) process:
  1. Log in to the firewall CLI.
  2. Restart the devsrvr process: debug software restartprocess device-server

• Initiate a Commit to Panorama operation followed by a Push to Devices operation for the modified device group and template configurations.
• Manually select the devices that belong to the modified device group and template configurations.

• set system setting dfa-mode [hw-dfa|sw-dfa]—Switch between DFA scanning options (persistent across restarts and does not require a reboot).
• set system setting dfa-mode-default—Restore the default DFA setting.
• show system setting dfa-mode—Show the current DFA scanning configuration.

• When you deploy a Panorama 8.1.2 virtual appliance, Panorama is unable to connect to the Logging Service and firewalls are unable to forward logs to the Logging Service.
• If you upgrade a Panorama virtual appliance with Logging Service enabled to PAN-OS 8.1.2, both Panorama and the firewalls will continue to connect to the Logging Service but will not display information about Logging Services instances when you run the request logging-service-forwarding customer info fetch CLI command.

• Active/active (in this example, the primary/secondary peers are firewall1/firewall2)—During the period after you upgrade firewall1 to PAN-OS 8.1 but before you upgrade firewall2, firewall1 loses user mapping information. When you finish upgrading both firewalls to PAN-OS 8.1, HA synchronization restores the lost mapping information on firewall1.
• Active/passive (in this example, the active/passive peers are firewall1/firewall2)—After you upgrade firewall2 to PAN-OS 8.1 but before you upgrade firewall1, firewall2 loses user mapping information but does not enforce policies because it is still in a passive state. However, after you trigger failover by suspending firewall1 (in anticipation of upgrading it), firewall2 becomes the active peer and fails to enforce user-based policies because its mapping information is still missing. After you then upgrade firewall1 and trigger failback, firewall1 resumes enforcing policy and HA synchronization ensures the mapping information is complete on both firewalls.

• Switch to the firewall Context on the Panorama management server.
• Commit changes when a dynamic update is being installed.
• Generate a custom report when a dynamic update is being installed.
• Generate custom reports during a commit.

• The firewalls hardcode the maximum segment size (TCP MSS) within TCP SYN packets and in server-to-client traffic at 1,460 bytes when packets exceed that size.
• PA-7000 Series and PA-5200 Series firewalls hardcode the maximum transmission unit (MTU) at 1,500 bytes for the encapsulation stage when tunneled clear-text traffic and the originating tunnel session reside on different dataplanes.

> configure

# set
template  <template_name>  config
deviceconfig high-availability interface ha2 ip-address <IP_address>

• You did not configure a worker list to add at least one worker node to the cluster. (In a two-node cluster, both nodes are controller nodes configured as an HA pair. Adding a worker node would make the cluster a three-node cluster.)
• You did not configure a service advertisement (either by enabling or not enabling advertising DNS service on the controller nodes).

• After you import the two-node cluster into Panorama, push the configuration from Panorama to the cluster. After the push succeeds, Panorama reports that the controller nodes are in sync.
• Configure a worker list on the cluster controller:

  admin@wf500(active-controller)# set deviceconfig
  cluster mode controller worker-list  <worker-ip-address> 

  (<worker-ip-address> is the IP address of the worker node you are adding to the cluster.) This creates a three-node cluster. After you import the cluster into Panorama, Panorama reports that the controller nodes are in sync. When you want the cluster to have only two nodes, use a different workaround.
• Configure service advertisement on the local CLI of the cluster controller and then import the configuration into Panorama. The service advertisement can advertise that DNS is or is not enabled.

  admin@wf500(active-controller)# set deviceconfig
  cluster mode controller service-advertisement dns-service enabled
  yes

  or

  admin@wf500(active-controller)# set deviceconfig
  cluster mode controller service-advertisement
  
  dns-service enabled no

  Both commands result in Panorama reporting that the controller nodes are in sync.

• nCipher nShield Connect—The firewall requires at least four minutes to detect that an HSM was disconnected, causing SSL functionality to be unavailable during the delay.
• SafeNet Network—When losing connectivity to either or both HSMs in an HA configuration, the display of information from the show high-availability state and show hsm info commands are blocked for 20 seconds.