General Topics

Resolved! Failed to establish SSL connection to Panorama Server

I upgraded a PA200 from 7.0.5 to 7.1.3 on friday.After the upgrade, the box show a MGT CPU load average on >80% and is not able to connect to Panorama anymore. The box is rebooted twice adter upgrade to try to fix this. Anyone know a fix?

What's going on with 7.1.4-h2 OS?

Hi, I think something not right with behavior changes on the release 7.1 with application defaults. Now my firewall blocking Sophos clients from communicating with my remote Sophos servers Sophos uses standard ports but look the firewall cannot catch the application ID and catching it as SSL on the port 8192/8194 and that make it not matching wi...

DHCP option 132 (IEEE 802.1Q VLAN ID) format for Mitel phones

Hi Guys, Can someone help me, please? DHCP option in Palo Alto DHCP server. Something that l have never configured before and need some clarification. So l want PA DHCP server to provide VLAN ID for the Mitel phones when they getting and IP address (DORA process). VLAN has to be 215 and options are ( ASCll and Hexadecimal). What option value d...

Scep configuration

Has anyone seen the below error whislt generating a scep certificate on a PA firewall?Kash

Public wifi clients unable to access our public web servers

Our public wifi traffic is unable to reach our external web servers that have public IPs (like webmail). The public wifi network is in the same zone, but it is assigned 172.30.0.0 IP, and we have ACLs to prevent the 172.30.0.0 network from talking to 192.168.0.0. It is also being outbound NAT so it gets assigned a different public IP address th...

Resolved! how to make ssh work on different port number

Hi, my colleague requested for some server to communicate to outside server (internet) using sftp. but they want to use port 9122.on the firewall rule i cannot find the way how to do it. i know sftp i using ssh port 22. i tried defining port 9122 and ssh as application but it doesnt work. anybody have any idea? tia chris

Clearing files to create space.

My PA200 is complaining about 10% space. pa200> show system files/var/cores/:total 4.9M-rw-rw-rw- 1 root root 652K Apr 24 20:21 core.20803-rw-rw-rw- 1 root root 652K May 17 13:44 core.17902drwxrwxrwx 2 root root 4.0K Jun 1 03:16 crashinfo-rw-r--r-- 1 root root 3.2M Jun 1 03:30 l3svc_7.0.6_0.tar.gz-rw-rw-rw- 1 root root 652K Aug 13 07:51 core....

Migration tool refuses HTPPS connection

Hello! I downloaded MT 3.1 for vmware player, imported it and turn it on. MT has ip adres 192.168.208.129 and I can ping it, but when I try to access it using HTTPS, it refuses connection. Does anybody had similar problem and how it can be solved? Best regards,Maja

Resolved! User-ID and internet access

Hello, If a user uses the PC at home (not behind the Palos) to access the Internet then hibernates their PC, then comes to work and connects to the network (behind the Palos) and un-hibernates, they can no longer access the Internet until the PC re-authenticates to AD and when the user-ID agent can identify the user again. There is a period when...

Resolved! New to Palo Alto device

I am a new technology coordinator in a school that has a Palo Alto device. I am new to these devices. The support contract (right term?) was up in 2014, and I would like to figure out how to get firmware (Pan-OS?) updates on the device. It is a PA-200. Can anyone point me in the right direction? I have searched Google and found lots of dead ends...

LSVPN Troubleshooting

I have all the guides for configuring LSVPN at the gateway, portal and satelite. I have done that and now verifying the LSVPN connection. This is the first LSVPN satelite to try and connect. Is there a good troubleshooting guide with steps for determing why the satelite is not connecting. As all are aware the issue could be either the gateway, p...

Check Dynamic Update Version On All Palo's From Panorama

Panorama has been great so far, but can I not check all my devices Dynamic Update Version from within Panorama? For instance there was the 613 update yesterday and some of our devices did not get the scheduled update due to the timezone they were in. So I have to log in to each Palo and check the Threat and Content version individually. We only...

Resolved! Recycling old Palo gear

Does anyone know of a recycling program for Palo Alto networks, we have an old 5050 in the office we want to get rid of (no support or licenses) and would rather not throw it in the trash

NAT public IP to two private IP as failover

Is there a way in Palo alto firewall to do that? is some one already using it? Example x.x.x.x (public) ------ Palo Alto (NAT) ----------------172.16.5.5 (primary) | 172.16.5.6 (bac...

OS 7.1 blocking telnet over SSL

We have in-house software that uses secure-telnet port 992 and that has been blocked after the 7.1.4-h2 upgrade. I've created a rule to pass the traffic to the destenation address with any application any service but never help, the logs said reset both by internzone rule, only changing interzone rule to allow will let the application communicat...