Ran into an oddity today, and I'm not sure if I fully believe support. I upgraded our firewall last week to 12.1.7-h3, all went fine system is running normally. Today I decided to start testing the new version of GlobalProtect (6.3.3-h11). When activating it, it asked if I wanted to do a system health report. Seemed kind of weird, would expe...
When reviewing security alerts, context is everything. Take Threat ID: 31671 ("SCADA ICCP Unauthorized COTP Connection Established"), for instance. The current description simply states: "This alert indicates that an ICCP client has successfully connected using OSI Connection Oriented Transport Protocol." While seeing a successful connection pop...
So I have a active/passive ha pair of 3410 firewalls. I need to move interfaces during production from ethernet1/1 and 1/2 to ethernet1/13 and 14 for 10gb bandwidth. Any best practices with minimal downtime? Thanks
Is there any spot where I can just download the documentation for the "admin" guide or the XQL reference that isn't just printing the web page to a PDF? Trying to use the new search function which forces the AI agent is not a pleasant experience for me.
Hello everyone, We're experiencing an issue with GlobalProtect on managed iPads and iPhones version 6.3.4-23. I'm trying to determine whether anyone else has run into this recently. Environment GlobalProtect VPN deployed via Microsoft Intune iPadOS devices Authentication through PingID (SAML) VPN type: Palo Alto Networks GlobalProtect Authent...
Hello, I am working on a Playbook to detect RDP/SSH communications between servers and automatically terminate the corresponding process when such communication is detected. As a preliminary test, I have configured a small-scale test to verify that the process can be automatically terminated. My current configuration is as follows. 1. XDR Enviro...
Hi I have a question regarding the output of the 'show system environmentals' command on the PA-5200 Series. Could someone explain the difference between 'NP / NP Core' and 'CP / CP Core' in the output results? In my opinion, NP and CP are likely hardware accelerators, such as a Network Processor and a Content Processor, respectively. However,...
Trying to configure Global Protect on new firewalls and update the MFA Current configuration:Clients configured w/always connected. Portal is configured w/pre-login device certificates from internal PKI. GW is configured w/LDAP and RADUIS. When a user tunnel is established, user must push yubikey to complete the config. New Configuration: We...
Hello Evryone, I'm tring to deploy a ztna connector on my home lab to prepare different use case for customer demo and i still have the same issue. Environment: Tenant type: NFR ZTNA Connector deployed on-prem via KVM (Proxmox VE), two-arm deployment Connector image: 200v-6.2.9-ztna-connector-b3-kvm.qcow2 (and try with 6.2.5 same issue) Port 1...
Hello All, Would SBAC also works for DLP (add-on) module events? We wou ld enable SBAC for those Endpoints with DLP enable by department. Then allow each department head as the Data Security Reviewer to view their own DLP events. Possible to do so? Thanks, SDH
We are changing our hypervisor platform from VMware to Hyper-V. Our normal migrate process (Shutdown, Backup with Veeam, Live Migrate to Hyper-V) failed with #Panorama, perhaps not unexpectedly How can I migrate my current setup?
hello experts, just exploring the new FIM module, is it possible to trigger an email alerts for the FIM events? will this FIM events be logged in one of the Dataset or preset? cannot find any clue. Thanks,
Has anyone else recently experienced problems with DNS Proxy stopping responding to client DNS requests? I run DNS Proxy on multiple sub-networks, such as our public Wifi zone, along with spyware/URL filtering for preventing access to malware/prohibited/etc. domains. The Security Policies prevent access to proxy avoidance and encrypted DNS. Fo...
I am having a hard time uninstall GlobalProtect version 6.3.3 The error message is saying The installer has encountered an unexpected error installing this package. This may indicated a problem with this package. The error code is 2503. I am trying to uninstall the package via Control Panel and it is giving me this error. I deleted all of the ...
Hello, How do i measure the effectiveness of your SOC’s alert triage and prioritization process?
