How to disable Telemetry?

How do you actually disable this new cloud telemetry? Last week I performed a PANOS update on my cloud NGFW firewalls and telemetry was forced on. The blurb in the firewall says to visit Hub->TenantManagement or Hub->StrataCloudManager->Settings->Tenant, neither of which exist as a path. The built-in PANOS documentation page says n...

Packet capture stops automatically

Is there any way to force Packet Capture to run for extended lengths? Since 11.1 PaloAlto has changed the underlying config and now forces packet capture to automatically end after 60 seconds. It's like no one at PaloAlto has ever used packet capture or had to track down an intermittent problem. The time limit can partially be increased with t...

Throttling ingress bandwidth on a sub-interface

Hi, I need to throttle 2 BYOD VLANs. On the Palos, they are configured as a sub-interface of aggregate ports. The QoS option will only accept physical interfaces or the aggregate port, not sub-interfaces to the aggregate port. Is there a way to accomplish this? There doesn't appear to be. More information all the firewalls are managed b...

PA-3440 VSYS license

Hello All, How can I to get additional virtual systems for my PA-3440? Is PAN-PA-3440-VSYS-10 the only valid license? Is there any other license with less VSYS available?BR Andrzej

Guidance on Getting Started with Enterprise DLP Testing for PII/PHI Protection

We recently deployed a Palo Alto Networks firewall and, as part of the implementation, received 200 Prisma Access licenses. I also requested an Enterprise DLP license for evaluation/testing, which has now been activated. Currently, we have access to the following components: Strata Cloud Manager Strata Logging Service Enterprise DLP Data Securi...

GlobalProtect Release for Ubuntu 26.04 LTS ?

Hello together.recently was the new Ubuntu 26.04 LTS release, until now the provided GlobalProtect client supports only Ubuntu 24.04:https://docs.paloaltonetworks.com/compatibility-matrix/reference/globalprotect/where-can-i-install-the-globalprotect-app?otp=linux#linux When can we expect the new GlobalProtect version for Ubuntu 26.04 ? Best re...

Traps For Expired Certificate

I am on 11.1.13 Does the NGFW or Panorama have traps for expiring or expired certificates? (Used for mgmt access and secure communications channel) I the trap below in MIB file for 11.1 however it does not seem to be triggering when certificate expires. .1.3.6.1.4.1.25461.2.1.3.2.0.3220 panTLSCertificateExpiredTrap

PANOS Integrated UserID with WINRM

Hello, I am trying to configure PANOS(10.1.8) Integrated UserID with Wndows AD 2016 (with Kerberos). I am getting "Access Denied" status under User Mapping --Server Monitoring I have validated that user is part of below security groups on AD Distributed COM Users Event Log Readers Remote Management Users Server Operators I see below log...

Questions about how to implement always on Primsa access VPN

We are looking to move all devices that connect to our Prisma Access environment to move to always on VPN. We attempted to do this once and caused the clients to black hole traffic. We are looking to use our internal certificate authority and each device has its own signed certificate for authentication for pre-logon. Is there a way we can limi...

Clarification on Strata Logging Service and eDLP Log Forwarding

Hi Team, We are an MSSP and have received a request to support eDLP. Since we do not have access to these devices/services in our environment, we primarily rely on the available documentation to understand and support them. I have a few questions regarding how Strata Logging Service (SLS) works. We currently support Prisma Access using SLS. Wh...

How deactivate multi factor authentication

Best Practice Configuration for SD-WAN Policy

Hi Everyone, I'm currently designing SD-WAN policies for our Palo Alto environment and would appreciate hearing about real-world best practices and deployment experience. I'm trying to determine which applications and traffic types should be assigned to Best Available Path versus Weighted Session Distribution. My current thinking is: Best Avail...

Github EDLs missing IPs?

Hi everyone, we've been using the Palo Alto managed GitHub EDL to allow access to GitHub and recently noticed some connections being blocked because the destination IPs aren't covered by the EDL. For example, we see successful connections to addresses like 140.82.121.x that are allowed from the EDL, but also connections to 20.250.119.67 and ...

Does the firewall need to have Panorama IPs in its permitted IP list for MGMT interface?

Does the firewall need to have Panorama IPs in its permitted IP list for MGMT interface? I tested and it seems I only need Panorama to allow FW IP. But from the article below for MGMT interface profile it mentions adding Panorama IP is required. https://live.paloaltonetworks.com/t5/general-articles/why-it-s-essential-to-secure-your-m...