General Topics
Post a discussion here if you have general questions regarding configuration and troubleshooting for Palo Alto Networks products. Use this forum to collaborate with like-minded security professionals to improve your security posture.
cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
General Topics
Post a discussion here if you have general questions regarding configuration and troubleshooting for Palo Alto Networks products. Use this forum to collaborate with like-minded security professionals to improve your security posture.
About General Topics
Post a discussion here if you have general questions regarding configuration and troubleshooting for Palo Alto Networks products. Use this forum to collaborate with like-minded security professionals to improve your security posture.

Discussions

Global Protect Client Backward Compatibility

Hi,

 

We have around 500 concurrent SSL clients connecting to our Palo Alto Gateway using Global Protect version 3.0.1.

 

If I activate the newest version on the Firewall (Version 3.1.3), will the existing clients be unaffected by this activation and con

...

MHaran by L1 Bithead
  • 2597 Views
  • 1 replies
  • 0 Likes

Resolved! PA support point to multipoint IPSEC VPN?

Hello

 

Does PA support point to multipoint IPSEC in hub and spoke VPN envorirnmet? Means Only one tunnel interface we create on hub and through NHTB protocol, nexthop is bind to SA.

 

Regards,

 

GR

Resolved! Static bidirectional NAT or soruce/destination NAT

Hello Experts

 

Someone from PA told me that for public service like email server, where bidirectional NAT is required, it is best practice to use source NAT and destination NAT for the same public IP instead of using static NAT because static NAT will

...

Resolved! Security policy and NAT - zone direction

Hello Experts

 

When I confiugre the NAT and associated security policy then I always confuse about the direction of zones. As I understand NAT zones are always determined by ingress interface zone (source zone) and route lookup gives the outoing inter

...

Proxy id between Palo Alto firewall and Cisco ASA

Hello Experts

 

PA side there are two subnets: 10.0.1.0/24, 10.0.2.0/24 and Cisco side there are also three subnets 172.16.1.0/24 , 172.16.2.0/24.

 

On PA firewall, I defined the proxy-id as below:

proxy-id1: local: 10.0.1.0/24 remote: 172.16.1.0/24 

proxy

...

Blocking Bittorrent

I have setup two rules for blocking bittorrent on a particular zone.  First rule is set to Deny Trust to Untrust using an application filter built with P2P applications.  Second rule is set to Deny Untrust to Trust using the same application filter. 

...

u10723 by Not applicable
  • 9857 Views
  • 18 replies
  • 1 Likes

Adding NAT rule order in Panorama cli

Hi all,

 

I am looking to add around 60+ NAT rules for monitoring over IPsec that requires a policy NAT. I need to have them above another rule in the list for it to work. It is a very messy NAT list that I don't have the freedom to clean up. The NAT e

...

PA allowing IM (viber,line,zalo) | PA policy process

Hi,

 

target is to allow im apps but modify categires.

 

I have created a policy allowing IM and modify most categories as block. 

 

Policy sample:

Policy is SRC: 192.168.x.x | DST: any | Srv: any | App: IM (viberbased,im,googlebased,ssl) | Url:BLK_CATEG

 

BL

...

Resolved! Public email attachment

Is there any way to block users' uploading attachment for public email (gmail, yahoo mail and hotmail) ? I created a security policy for allowing applications (gmail, hotmail, yahoo-mail) and associated with file blocking profile but didn't work. Ple

...

Resolved! Crossover cables on PA-7050

Hello,

 

I found that for HA1 when there are directly connected, Palo Alto recoments to have them interconected with crossover cables.

is this the same with PA-7050?

https://www.paloaltonetworks.com/documentation/70/pan-os/pan-os/high-availability/config

...

Kaliman by L2 Linker
  • 1995 Views
  • 1 replies
  • 0 Likes

URL Filter vs. Type in firewall?

Does the URL filter at urlfiltering.paloaltonetworks.com have anything to do with how a Palo Alto firewall classifies the 'type' of site?

I noticed that there are some sites that our firewall classifies as 'spyware' that the URL filtering site classif

...

StacyE by L0 Member
  • 2124 Views
  • 2 replies
  • 0 Likes

Global protect error certificate

Hi,

 

We are having problems with globalprotect. We have tried installing several GP client versions 2.3.1,2.3.5 and 3.1.3 but the result is the same.

We cant connect using Windows or MAC, we receive a certificate error.

We read in the KB paloalto that c

...

Resolved! HA pair issue PA-500

Hi Guys,

 

Interesting one. Devices are in HA pair of the PA-500. Suddenly we are no longer able to access the active device through the

 

GUl, but able to ping mgmt interface and SSH to it. When SSHing getting the screen below:

 

 

A firewall in not produc

...

ssh error.PNG
error.PNG
state.PNG
int-state.PNG
  • 24034 Posts
  • 102 Subscriptions
Top Liked Authors
Labels