Rule has application any and port 3389 we see discard for application cotp

We have security policy to allow any application on port 3389.

I see users are able to connect to server on port 3389.

traffic log shows denied on application cotp.

my understanding is that if you have application as any it should cover all the applic

Accessing Mgmt Interface over IPSec

Hi Team,

Is it possible to connect to Mgmt interface over the IPSec tunnel from external interface?

Regards,

Sanjay S

GlobalProtect not allowing internet access when Parallels or Docker are running

MacOS installed: macOS Sonoma 14.5 latest

GlobalProtect client installed: 6.0.7-372

Parallels Desktop: 18.2.0 (53488)

As the post title says, when Parallels or Docker are running, our GP isn't allowing network access (myself and others are having s

Issues with decryption on versions higher than 10.2.8-x, TAC no help

Brief summary, we have a pair of 3420's that where on 10.2.8-h3 for several months with no issues, suddenly one day we had issues with what seems to be OOM but was never fully confirmed by TAC, but recommended to upgrade to 10.2.10-hx(we choose 7 as

radius and PANF gui

Hello ,

I have integrated Radius with VM FW

the ssh to FW works . I have not created any local user on FW , All users are on radius server

but gui to FW does not work  with radius account ;

when i enter radius creds in gui , it accepts and co

LDAP

We plan to enable channel binding for LDAP on our domain controllers.  Since the firewalls use LDAP for querying AD information from the domain controllers, do we need to make any configurations to the firewalls to be compatible?

Intrazone-default rule

Hello,

I would like some advice on Palo Alto's default intrazone-default rule.  Unless I have a drop any any above this rule I see IP's from all over the public internet hitting my Palo Alto and being accepted on the intrazone rule as the traffic is

Tests anti-malware signatures before releasing them to the public

I would imagine Palo Alto tests dynamic updates such as  Antivirus and Device-Dictonary signatures through a rigorous process before releasing them to the public.  Does anyone know where I can find that process?

List of domains to allow for in-flight WiFi

Hi all,

I've been working with a number of customers lately who have been trying to gather a list of in-flight wifi domains that they need to allow as GlobalProtect Enforcer exceptions and I thought I'd share them here. I'd also ask that you please

PA restart with Internal packet path monitoring failure

We have a pair of 3220 in a cluster. Yesterday we upgraded to 10.2.9-h11 and today we faced a restart of the Active peer twice with this error:

Internal packet path monitoring failure, restarting dataplane

I could not find any bugs related to this

PA-445 stability?

Anyone else having issues with PA-445 stability? We're doing our 2nd RMA in less than 6 months on a PA-445 that just randomly restarts. It's on dual independent electrical circuits (with UPSs). After the first RMA it did it again and support said it

Log Forwarding - Traffic Works, Others Do Not

I have to be missing something simple, for forwarding logs to a collection server. I can get the traffic logs, no issues, but all the other logs, will not send (Threat, Wildfire...). Do the other logs need some kind of special forwarding, or permissi

Max Tunnels for GlobalProtect

Can someone help me to understand the maximum number of concurrent connections possible with the GlobalProtect Clientless VPN solution? Preferably any documentation where this is specified would be great!