General Topics

Panorama licensing

I think that this is simple but I am just missing it. I am looking for what my license limitations for my Panorama are. I have looked on my support site and googled it but I seem to be unable to find it.Essentially I have a number of devices currently connected to my Panorama and I need to add more and I just want to make sure that my Panorama i...

Overlapping Subnets and NAT

Hello, I have a new client we have a direct L3 link with. Our firewall has an existing directly connected interface on the 10.10.0.0/16 subnet. Our client also has a subnet of 10.10.0.0/16 which we need to get to. During my initial testing I decided just to access a /24 of the clients /16. I am natting the client subnet of 10.10.101.0/24 to 172....

Issues with ipsec traffic from PA3020 to Cisco 871.

I have a working tunnel between Netscreen and Cisco 871. I tried to move this from Netscreen to PA3020.The tunnel comes up. PA3020-local network-192.168.2.0/24 and remote-192.168.235.0/24.Traffic from 2.0(palo side) to 235.0(cisco side) network is fine. But from 235.0(cisco side) to 2.0(palo side) we have issuesOnly thing which works is ping. rd...

Resolved! Application Dependency question (l thought l knew it)

Heys, A bit confused now :0 My policy as below: So port 80 is allowed when l attempting to connect to the device over the web browser (Chrome) but after Palo actually identified that this is not a "panos-web-interface" app (based on tcp 3 way handshake and some data) didn't the response to the request. I understood that there is no other way t...

What's new in MineMeld 0.9.36

Release Date: 2017-03-21 How to update: Updating MineMeld Nodes JSON Miner now supports Basic Auth via prototype (suggested by @Kimwii) TAXII Miner now supports subscription_id, client cert support has been improved, added support for LinkObjectType constructs and a starting support for AND Observable Composition (thanks @pjames_ucla) WebU...

Resolved! DMZ to inside LAN

I know you need a security policy to go from dmz to Lan but do you need a nat statement. On all the Palo Alto documents that I have seen no nat rule is used. If I am wrong could some one send me a link. Thank you

Global Protect: Two preferred NIC listed

Windows 7 laptops with global protect client installed. When I plug my laptop into a wired(ethernet) connection, the wireless IP and the wired IP are showing up as preferred. If I remove global protect from these laptops the wireless IP goes away when I am on wired. We are starting to field help desk calls about slowness to all network resources...

Created new certificate for decrypt, now I can't commit because of global protect error

Hello everyone, I created a new certificate for SSL proxy and now for some reason I cannot commit. The error I get is "error applying transform globalprotect-pre-transform.xsl to config tree", AFAIK there was/is a completely different certificate for global protect connections.Does anyone have a clue where I should start to search for the problem?

Resolved! Reset pass user admin via web

Hi, How I do reset the password user admin again??? I have this messages "bad gateway" when I put the credencials on the access web. I can't login Do you kwon something about this, please? Thx

Resolved! Problems users with Windows 10 and User ID agent

Hello, I need your help with the following scene:I have some machines with Windows 10 Operative System and I have detected a problem with the PA Firewall. The Firewall is not detecting the user (UIA), so the policy rules are denying the access.Panos firewall: 7.1.4User Id Agent version: 7.0.4-5I have machines with Windows 7 SO and I don't have a...

QoS theory / functionality

Hi, We have an interface which is 100Mbps. There will never be more than 20 IP addresses connecting on this interface. I wish to guarantee each connection 5Mbps and allow them to use the entire 100Mbps if the additional bandwidth is available. I can create a QoS profile with a class specifing the guaranteed and max bandwidth, and assign it to a ...

Resolved! Package minemeld not found

Refer to the KB below and install it.However, even if you implement 5. Installing MineMeld,The following error will be output. https://live.paloaltonetworks.com/t5/MineMeld-Articles/Manually-install-MineMeld-on-Ubuntu-Server-14-04/ta-p/98454 Since Ubuntu has installed ubuntu server- 14.04.5 LTS - i386.

DNS traffic identified as sophos-live-protection

Some DNS traffic is classified as sophos-live-protection in our traffic logs. Has anyone else seen this? I only have logs 5 days back in time, so I cannot say when this started but it wasn't with the latest apps update. Our firewall is PA-5050 running PAN-OS 6.1.14.

Globalprotect client

I want to do some testing on new global protect clients but I don't want to make it update anyone tell I can test it, How do I get the software to test with out making it the default cleint on the firewall?

Security policy: exception question

Hi, I'm trying to create a security policy that would block all critical traffic from source zone "A", to destination zone "B". However, I want to allow traffic from a specific IP in zone "A". How can I make an exception to allow that IP? I assume I could create a policy to allow that IP and then one below it block traffic from that zone but I w...

Discussions

Panorama licensing

Overlapping Subnets and NAT

Issues with ipsec traffic from PA3020 to Cisco 871.

Resolved! Application Dependency question (l thought l knew it)