Clarification of rule processing order?

I had two firewall rules in the following order:

• Any Internal > Any External > Any Application > Service TCP 80/443
• Any Internal > Any External > Application filter "web browsing" > Service "App Default"

With a "decrypt" profile on web based email

Suspended state. Peer device VM number of cores not matching

During high availability configuration both of devaces going to suspended state  with error : Peer device VM number of cores not matching; going to Suspended state. I am trying to configure HA  in PA200 VM.

what could be the problem?

Global Protect Limitations

Is there a way to stop disabled AD computer accounts from connecting to GP?  We have a HIP profile attached to the GP rules which force the user to be compliant (ie. member of domain and have AntiVirus).  however, when we disable their computer accou

data filter on comment

Hi community , 

is there any way to filter comment contained some bad words (f**ck , so on)  that is written by our employers to add any website(often use  http) ? 

Best practiecs

Is anyone using these recommended settings?

set deviceconfig setting tcp urgent-data clear

set deviceconfig setting tcp drop-zero-flag yes

set deviceconfig setting application bypass-exceed-queue no

set deviceconfig setting tcp bypass-exceed-oo-que

PANOS 7.0 SNMP logical interface counters

I tried the feature and the RX and TX counters are a way off from the physical interface (Tested on 5060 using e1/21 and e1/22 for AE1).   I opened a case with TAC,  and this is the explaination from TAC,

For hardware interfaces (ethernet1/21 and e

When will a new GlobalProtectClient GUI/UI be written?

We've been holding off replacing our Cisco Anyconnect clients as the interface of GlobalProtect is a big downgrade for us.

Any idea when/if there will be improvements made to the GP UI?

At the moment it looks like it was developed by engineers with n

Crazy policies needed for BGP and VPN

Hi,

first read this article:

https://live.paloaltonetworks.com/t5/Learning-Arti​cles/Any-Any-Deny-Security-Rule-Changes-Default-Be​...

then

 I have this exactly behavor but I don't have wrote any/any/deny rules!

In my enviroment both intrazone-defa

Vulnerability exemption

Hi

what is actually
simple-client-critical
simple-client-medium

I

I  want to change the default action from alert to block .
the rule is under simple-client-medium , but the search result shows it is under
simple-client-high

Thanks

URL White Listing

Hi all,

First of all, we are impressed about MineMeld, thanks Luigi for your ideas and work.

We have just started to play with MineMeld and wandering the format to whitelist domains and network ranges using stdlib.listURLGeneric (as wlURL)

We would l