General Topics

Discover LIVEcommunity Through Our New Animated Explainer Video!

We’re thrilled to unveil a brand-new animated video that highlights everything LIVEcommunity has to offer! This short and engaging video gives you a quick tour of the many resources available in our vibrant community — from interactive discussions and customer journey guides to the Cyber Elite program and Member Spotlight features. Whether ...

Resolved! Security policy and NAT - zone direction

Hello Experts When I confiugre the NAT and associated security policy then I always confuse about the direction of zones. As I understand NAT zones are always determined by ingress interface zone (source zone) and route lookup gives the outoing interface zone (destination zone) but my question is when we confiugre the associated security policy ...

Proxy id between Palo Alto firewall and Cisco ASA

Hello Experts PA side there are two subnets: 10.0.1.0/24, 10.0.2.0/24 and Cisco side there are also three subnets 172.16.1.0/24 , 172.16.2.0/24. On PA firewall, I defined the proxy-id as below:proxy-id1: local: 10.0.1.0/24 remote: 172.16.1.0/24 proxy-id2: local: 10.0.1.0/24 remote: 172.16.2.0/24 proxy-id3: local: 10.0.1.0/24 remote: 172.16.1.0/2...

Blocking Bittorrent

I have setup two rules for blocking bittorrent on a particular zone. First rule is set to Deny Trust to Untrust using an application filter built with P2P applications. Second rule is set to Deny Untrust to Trust using the same application filter. I am able to block any uploading content, but the filter doesn't block any torrents from downloa...

Please explain the PanDB/Brightcloud's category “not-resolved”？

Hi,Guys: I found the category "Not-resolved" in device GUI(Both Pandb and Brightcloud), I searched it in paloaltonetworks.com and brightcloud.com website, But could not get any description about it. Any guy explain it ? Thanks Victor.Bai

Adding NAT rule order in Panorama cli

Hi all, I am looking to add around 60+ NAT rules for monitoring over IPsec that requires a policy NAT. I need to have them above another rule in the list for it to work. It is a very messy NAT list that I don't have the freedom to clean up. The NAT entries are being added to a device group in Panorama. Thanks in advance, Danny

PA allowing IM (viber,line,zalo) | PA policy process

Hi, target is to allow im apps but modify categires. I have created a policy allowing IM and modify most categories as block. Policy sample:Policy is SRC: 192.168.x.x | DST: any | Srv: any | App: IM (viberbased,im,googlebased,ssl) | Url:BLK_CATEG BLK_CATEG (list of blocked categories)News / MediaTravelVehiclesSports / recreationsSociety and Lif...

Resolved! Public email attachment

Is there any way to block users' uploading attachment for public email (gmail, yahoo mail and hotmail) ? I created a security policy for allowing applications (gmail, hotmail, yahoo-mail) and associated with file blocking profile but didn't work. Please advise if the configuration is correct.

Resolved! Assign a new QOS profile to just one tunnel on a tunnel interface

Hi Guys, I'm rather new to Palo and this community, so forgive me if I don't do this right. We need to restrict the Egress Max of just one tunnel (out of 9) on a tunnel interface.The config looks like this right now: I would like to change just tunnel 9 to 1Mbps. How would I go about doing that? Thanks in advanceRonelle

Resolved! Crossover cables on PA-7050

Hello, I found that for HA1 when there are directly connected, Palo Alto recoments to have them interconected with crossover cables.is this the same with PA-7050?https://www.paloaltonetworks.com/documentation/70/pan-os/pan-os/high-availability/configure-active-passive-ha because at this point it's working with straight thru cables. Could you ple...

URL Filter vs. Type in firewall?

Does the URL filter at urlfiltering.paloaltonetworks.com have anything to do with how a Palo Alto firewall classifies the 'type' of site?I noticed that there are some sites that our firewall classifies as 'spyware' that the URL filtering site classifies as other (not malicious) categories. I'm trying to understand what is the most expedient way ...

Global protect error certificate

Hi, We are having problems with globalprotect. We have tried installing several GP client versions 2.3.1,2.3.5 and 3.1.3 but the result is the same.We cant connect using Windows or MAC, we receive a certificate error.We read in the KB paloalto that could be because the FQDN of the computer must match the machine name on the certificate, we tried...

Resolved! HA pair issue PA-500

Hi Guys, Interesting one. Devices are in HA pair of the PA-500. Suddenly we are no longer able to access the active device through the GUl, but able to ping mgmt interface and SSH to it. When SSHing getting the screen below: A firewall in not producing any command output and doesn't see itself as in HA pair, no (active). The passive device stil...

How to blok vbs file into zip file?

Hello, I am getting lot of files (worms) through smtp as vbs file which are put to zip file. This zip file is not encrypted. How can I block this threat.?

GlobalProtect : Need a VPN that separates users into different VLANs; is this possible w/o Panorama?

I need my client VPN to support different vlans based upon authentication to either Microsoft NPS or LDAP groups.I want a different vlan/IP assigned to the user depending on which group in Active Directory they are in.Is this configuration possible without purchasing Panorama? Thanks!

Resolved! Win32.malicious.dhlx

Is anyone seeing this on their palo alot blocking some traffic?