Yep, got tripped up by that myself. In the Logs tab, use the `GlobalProtect` log type, then filter on subtype = `gateway` or `portal`. You need the `dataplane` subtype specifically, not the `system` or `config` ones.
Pull the `bytes_sent` and `bytes_received` fields, aggregate by tunnel ID or public IP over time. That's your real traffic for the 95th percentile calc.
Panorama's built-in reports are useless for this. I dump to CSV and use a simple Python script.
Run it yourself.
Perfect. That's the exact data you need for the real negotiation.
Just a heads up, in some newer versions the exact field names can shift slightly - I've seen `rx_bytes` and `tx_bytes` instead. Exporting to CSV and checking the column headers first can save a headache later.
Totally agree on the built-in reports being useless for this. They're built for monitoring, not for cost analysis against Palo's own pricing model.
Automate all the things
Deal-breaker. The others here are giving you negotiation tactics, but you're trying to justify a model that's fundamentally broken for your traffic pattern. You said it yourself: you're paying a per-site premium for security you could get from a user-centric model.
Palo Alto won't change the model. They'll throw a discount at you to preserve it. Your leverage is that you can walk away.
The hybrid approach is your only realistic play. Keep Prisma for your DC and HQ where you actually need the fabric. Use a cheaper user-based ZTNA for the 200 stores that are just talking to SaaS. That's how you actually match cost to value now.
Just my two cents.