General Topics

Embedded Word Templates - Clients on external networks to reject immediately

Hi Guys Wondering if anyone has any ideas on; There are external clients / users attempting to open word documents that use word templates stored on the corporate network drive. When the user is offsite and not connected to Global Protect or VPN and the user attempts to open the document, Word will attempt to open the template on the network dr...

PA strange behaviour

Hi, Last night (1.30am) it was a electric cut down in my office. This cutdown didnt affect to our PaloAltos but since this time we are expecting an strange beahviour in our Palo alto. During this morning the FW were flapping and we found one member in suspended state (reasons loop protection) Now its working fine but we are not sure about the st...

Resolved! Active Passive HA

I'm trying to setup HA for a pair of HA-3020 and the HA widget is all green and synched. I have a network connection on our cisco core on Ethernet1/3 for the trusted network called TrustedL3 on the Primary firewall. Do I need to use the same IP number from the Primary to the Passive firewall? I am routing my traffic to the internet from my loca...

DNS tunneling seems it's not recognized as "tcp-over-dns"

Since some weeks, we are suspecting DNS Tunneling usage.We saw a specific "application" being present on applipedia for this kind of action: tcp-over-dnsApplipedia description states:"DNS Tunneling is a technique to encapsulate any binary data within DNS queries and replies and tunnel it to any remote system and the Internet. There are several t...

Resolved! PAN OS 7.0.9 Issues???

I updated my 4 HA Pairs this wekend to 7.0.9 because we were running into an issue with Ldap periodically corrupting and locking users out of the GP portal. Anyone else on this release. any issues?

how to block ultrasurf all version

please ...anyone to know how can i block the application ULTRASURF in PA 6.0.7

url filtering flow

The url filterng flow is like below:data plance -> management plane -> cloud. I am seeing the category of ome sites is different than test url site of palo alto. For Ex: In Palo alto firewall below command gives this output show running url xxxmalaware which means the the ur category in data plane is malware. However when i run test url xx...

Resolved! HA peer split-brain recovery?

Hi Guys, l came across this nice article where Mivaldi explains what is peer split-brain https://live.paloaltonetworks.com/t5/General-Topics/What-is-Peer-Split-Brain/m-p/19825#U19825 I have a question. We don't have HA1 backup link configured and our Heartbeat Backup (mgmt port) were not reachable between to PAs. This is all to the switch issue...

Resolved! What is Peer-Split-Brain?

Hey all, I want to start off saying I love Palo Alto's, they are AMAZING! With that out of the way, I wanted to say I recently got a Device RMA'd and the process went amazingly smooth, and I actually was able to completed a HA peer PA-500 in less time then it took my provider to get my a digital key for some software! This was the guide I fo...

Resolved! HA PA-5050 Alerts

Hello All, Guys could you help with this. PA-5050 Active/Passive setup. Received an alerts. Details below: Active: 2016/08/25 01:02:28 info ha session 0 HA Group 1: Completed session synchronization with peer2016/08/25 01:02:25 info ha session 0 HA Group 1: Starting session synchronization with peer2016/08/25 01:02:25 info satd satd-ha 0 SATD da...

Resolved! Using Users instead of Groups in Policies - Help please

Hello all, I'm new to PA but I'm really enjoying it...anyway, I've read everything I could find aboud group mappings, and one very good link is https://live.paloaltonetworks.com/t5/Featured-Articles/Getting-Started-User-ID/ta-p/69321 .. but it only show how to use a group in a policy. Is it possible to use a "user" instead of a group in a policy...

How to Allow File Downloads from a Specific URL

Hello all,Is there a way to allow file download/upload from a specific URL? We currently block most file downloads/uploads however we have specific website that users upload and download attachments toover https. Thank you all for your help!

security policy order not working.

I have a policy from trust to untrust any any allowed. I have cloned this policy and put on top of this with address -test and deny 2 applications. This address is an ip for eg. 192.168.1.26 which is reserved in dhcp. But I can see apps being access via any any policy. Should the address be blocked using block policy.

No direct access to local network

Hi team, Good day!As I have understood, this feature will provide compulsary full tunnel and all my traffic will be set to inspection by firewall. I won't be able to access anything local. Can anyone confirm.

CLI question - What's the difference between: "receive errors" and "receive incoming errors"

Hi There, We haev aggrgate interface called ae2, and we have some problems with the traffic related to this interface so we run the commnand show interface ae2and show interface ethernet1/3 (which is one of the interfaces inside ae2)(the ouput is down) can someone please tell me the difference between: "receive errors" and "receive incoming erro...

Discussions

Embedded Word Templates - Clients on external networks to reject immediately