General Topics

Recommended PAN-OS for 5220

We are currently running version 10.2.9-h1 and i would like to know what the prefered recommended version to upgrade too? Also why does palo alto deny me access to this information when i have an account with them? I upgraded to 10.2.11 but this caused service impact. All our hosts dropped every hour on the hour until i reverted.

Request to Remove High-Risk Status and Update Website Category for ice-aec.com

Dear Palo Alto Networks LIVEcommunity Team, I am writing to address a concern regarding the domain ice-aec.com, which has been flagged as high-risk by Palo Alto Networks Unit 42 Security. After conducting a thorough review, we believe that this classification may be due to certain components on our site that could be mistakenly identified as m...

Export Information for a PA-460 Unit

Could someone at Palo Alto please provide the following information for your PA-460 unit (3 items total): 1. ECCN (Export Control Classification Number) 2. Harmonized Tariff Code (HTS Code) 3. CCATS information for this product - we need to see if you have a license exception on the CCATS We need to export two of these units from the USA to Mexi...

broker vm

Hi, i want to sign in broker vm the first time. but default password !nitialPassw0rd don't work. can you help me with his problem. Thanks.

Paloalto (HA) and Fortigate (HA)

Hello All, what is the recommended connectivity for if there 4 firewalls and HA is active/passive on both devices: PA-active connected to (Fortigate active and passive) PA-passive connected to (Fortigate active and passive) Thank you

Find tempalate name to which a certificate is associated with

Hi All Can any one please tell me the api code or curl command to find tempalate names to which a certificate is associated with. Generally we do this via global search option but can't find anything to do on cli or via api.

Resolved! Firewall (10.1.10-h1) Unable to connect UID agent (10.1.2)

UID agents version 7.0.8 upgraded to 10.1.2.DC (10.2.9)and Perimeter (11.1.2-h3) firewalls connected to Newly upgraded UID agent but unfortunately all branch firewalls(10.1.10-h1) couldn’t make connection to upgraded UID agent and is showing certificate error in logs.So we have downgraded the UID agent version to 9.0.5 and working fine with all ...

Resolved! URL exeptions best practis

Hi All.I'm new in Palo Alto.My goal is to exclude some IPs (Mainly some Broadcast TV channels) from scaning and intrusion ditection, for improving throughput. Now there are some ways to achive this, but i wondwer what is the best way? Regards' Goldy

GlobalProtect VPN on Win11

When I attempt to connect to a GP VPN site I get an error "Can't reach this page" - but only on my Win11 laptop. I used to be able to connect with this PC but not anymore. Tried removing all the updates - still no luck. I have 2 other laptops, both Win10 still - and no isssues. Is there a known Win11 issue with GlobalProtect?

Resolved! Croxyproxy Block

Hi Team, We want to block croxy proxy in palo alto firewall. There is no application for this proxy to block. We already tried blocking the category proxy avoidance but it doesnt help even after applying it after decryption ssl packets. We are seeing URL is getting changed and hitting the server until it get sucessful connection so some URL cat...

Resolved! Palo Alto VM seris HA and vSYS

Hello, I have a question regarding Palo Alto VM series HA and vSYS, when I tried to create a new profile with the credit needed for two virtual Palo Alto each one of them installed on a seprate ESXi host , but both ESXi host are in the same location and they have the same network and we need them in HA active/active mode , I choose to add flexib...

Pushing dynamic updates from Panorama to firewalls or download direct to firewall

Looking for advice on best practice regarding dynamic updates (AV, IPS, WF) when managing firewalls from a Panorama. Currently we are download and pushing these dynamic updates from Panorama to about 15 firewalls but will be managing more firewalls from Panorama in the future. We have discovered some of these dynamic update jobs becoming hung an...

Unsupported cipher. Supported client cipher bitmask: 0x00000000

Hi,have a decryption policies for inbound ssl decryption to a webpage. Therefor I have included the private Certificate.At decryption monitor there is a message:( error eq 'Unsupported cipher. Supported client cipher bitmask: 0x00000000. Supported decrypt profile cipher bitmask: 0x00000014.' ) Found this link https://docs.paloaltonetworks.com/pa...

Migration FW Paloalto model from 3020 to 1410

Hello team, I need to migrate a cluster from FW model 3020 to 1410. Can any of you tell me the best way to change it? I have the 3020 configuration in XML in version 9.1 but the 1410 the minimum version required is 11. Can you help me? Regards.

Notification when software versions get marked as Preferred

Is there already a mechanism or something I can subscribe to to receive updates when a software version is selected as the Preferred release? I get the emails notifying me of new releases, and I frequently use the Support PAN-OS Software Release Guidance post to check on things. I see that there is an option to Subscribe to the post/thread, but ...