• 531,486 Members
  • 1,345 Online
  • 1,134,160 Posts
  • 19,937 Solutions
  • 53,936 Likes

Welcome to Palo Alto Networks LIVEcommunity

Find answers, share solutions, and connect with peers and thought leaders from around the world.
New to LIVEcommunity? Check out our Welcome Guide.

Community Activity

Malware detection

Hi Team, In our environment, a file was detected as malware. Based on the investigation, the file was downloaded using Firefox. We need to identify the exact source URL from which the file was downloaded. We have already checked the Causality Chain for the file, but multiple URLs are displayed, making it difficult to determine the actual downloa...

Setting up HTTP server for POST alerts

Anyone have tips or tricks or a guide on setting up and troubleshooting sending logs to HTTP POST?In Panorama, I configured Server Profile > HTTP > set up new server profile.Under Payload Format, starting with Config and System, I set the URI.If I click "Send Test Log" all I get is a generic "Failed to send HTTP request: Invalid configurat...

rjfoster by • L1 Bithead
  • 24 Views
  • 0 replies
  • 0 Likes

Upcoming Change: Telemetry Enablement for Eligible PAN-OS NGFWs

3 min read

Overview Palo Alto Networks is enabling device telemetry on eligible PAN-OS NGFWs to help improve threat detection, enhance visibility into device health, and accelerate support case resolution. This update is rolling out in three waves. If your firewall meets the criteria below, telemetry will be enabled automatically and no further action i...

Upcoming Change.png
gagsingh by • L2 Linker
  • 2201 Views
  • 14 replies
  • 6 Likes

GlobalProtect Frequent Disconnect and Reconnect Issue for Some Users

Hello Community,We are experiencing an issue where GlobalProtect frequently disconnects and reconnects in a loop for some Windows users.The issue is intermittent. More than 90% of our users are working normally, while fewer than 10% are experiencing the frequent disconnect/reconnect behavior.For the affected users, GlobalProtect connects success...

Config ingestion and SDWAN

I've been getting a lot more requests to import existing standalone firewall into SCM. That's fine and dandy but I've been testing and the convert works and then the push fails because there is already config there it thinks it conflicts with. Why doesn't it override the existing like Panorama did upon ingestion? There is no good documentation f...

PAN-OS 11.1 — Source-Based DNAT on TCP 443 While GlobalProtect Uses Same Public IP

Subject: PAN-OS 11.1 — Source-Based DNAT on TCP 443 While GlobalProtect Uses Same Public IP We have a PA-460 running PAN-OS 11.1.10-h1. Our GlobalProtect portal and gateway are both bound to ethernet1/1 on the same public IP, using TCP 443. Authentication is handled through Duo SAML. We need to expose an internal HTTPS/WCF application on TCP 443...

mikeb by • L0 Member
  • 35 Views
  • 0 replies
  • 0 Likes

Prisma Acess Agent EPM issue

I have a PAA agent installed onto a Windows machine and when the vpn tunnel is down the EPM status is up and working but as soon as we bring the vpn tunnel up the EPM status goes down indicating a SSL handshake failed, now ive eliminated DNS issue with/without tunnel, all good, ive disabled dencryption of any *.gpcoudservice.com traffic within p...

Broker VM image migration (Ubuntu 20.04 → Debian 13+): does the WEC server certificate carry over, or do WEF client certs need reinstalling?

Hi everyone, We’re about to migrate our Broker VMs to the new image and I’d like to hear from anyone who has already done this with the Windows Event Collector (WEC) applet in play. Our setup: Cortex XSIAM, 6 Broker VMs on 31.100.2, running Ubuntu 20.04.6 LTS. Per the “Upgrade Broker VM” docs, nodes on an old image (Ubuntu 20.04 or earlier) mus...

Need Policy for MS System Center

Dear All Need help. Recently, we have observed that the Palo Alto firewall shows an alert on the dashboard when a Microsoft System Center user tries to scan and push updates from their workstation. This is routine work for some support users. If it happens regularly, we report this alert and inform higher management why it happens. But it doesn...

rockbd by • L0 Member
  • 81 Views
  • 1 replies
  • 0 Likes

What Is "GPCS-sc-interfw-rule" on Log Prisma Access

Hi everyone, I recently set up a Service Connection (SC) via Strata Cloud Manager (SCM), and the tunnel is successfully established. To test the policies, I disabled the rule allowing traffic from SCM to the Peer DC (Firewall). Currently, I'm experiencing a one-way communication issue: GlobalProtect (GP) users cannot ping or access apps in the...

R.PUTRA by • L0 Member
  • 108 Views
  • 1 replies
  • 0 Likes

Unable to Create a New Support Case – Portal Access Issue

Hi Team, I am encountering the error message shown in the attached screenshot when trying to create a new support case. After logging into the portal, when I attempt to create a case for one of my customers, I receive the attached error message. Could you please look into this issue and help me resolve it? Please let me know if you need any addi...

Trying the DNSProxy feature for Static Response

Hie, Situation - Wanted to kaminsky the DNS Responses for my client from the FWComplication - None of the dig are responded Need your help on this? Client Requests for Promise/Spoofed IP keviv@keviv-VMware-Virtual-Platform:~$ ifconfig ens37ens37: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500inet 192.168.21.21 netmask 255.255.255.0 ...

ocpfn4 by • L0 Member
  • 610 Views
  • 1 replies
  • 0 Likes

What does Portkey Error Code 033 mean, and how can it be resolved for MCP Gateway access?

IssueWhy does an Active Service Gateway API Key with MCP → INVOKE permission receive HTTP 403 / Portkey Error Code 033 when invoking MCP servers provisioned to the same admin-automation workspace in Strata Cloud Manager (SCM)?Environment / BackgroundI am evaluating the PRISMA AIRS / AI Gateway MCP functionality in an SCM trial tenant.A Tumor Boa...

Upcoming Fuel Events

Top Solution Authors
Top Contributors