Logs from the CLI

We've had suspicions that there have been logins from an unknown source via the console. "User admin logged in via CLI from Console" None of the team have stated they logged in around 1am to the box, and the room is locked with a pin. Is there anyway, apart from comparing configurations, and seeing what admins have logged on (I only have one adm...

How to Upgrade - GlobalProtect Agent Upgrade Process

I am looking for the link that says that you cannot upgrade directly to anything past 7.01 without breaking certs.

Does anybody know where I can get a .ova file for setting up a virtual lab?

User-ID agent configs in multiple templates not stackable??

I'm only able to get User-ID agents pushed to the firewall that are in the top template in the stack. I was quite certain this worked when I installed it but have since done OS upgrades. Panorama is 7.1.2. I have the User-ID agents running on two servers there in my "Global" template and then on the device specific template I need to have my PA ...

Autocommit failed. Device not up :(

Hi, I have installed the version 6.0.13. we had a eeroor doing commit "Threat database handler failed" so we decided to restart the device and now the autocommit is failing and the device is not going up. We can access by ssh and GUI but the service interfaces arent going up. I have tried to downgrade to 6.0.3 and upgraded again to 6.0.13, but t...

Analysis and control of protocol running in SSH like SFTP

Hi, Any ideas on better controlling what gets transferred over a decrypted (by the Palo Alto's ssh decryption feature) SSH session. I don't see an option blocking file up- or downloads via the fileblocking feature for SSH or an other corresponding protocol, nor is it possible creating a custom definition (for what's being transferred within SSH)...

session end threat

I had a user that was not able to connect through a mapped drive to one of our servers. Looked in the monitor and it said session end reasson threat but it didn't identify anything about the threat not cve no ID information

Blocking EXE files but allowing file names

Hi guys, I'm trying to block .exe files, but allow file names for some users. For example, I would like to allow the GoToMeetingLauncher.exe for GoToMeeting webinars, but the links look like the below which means it can't be done. https://download.citrixonline.com/launcher2/helper?token=e0-qZ0xbknQkdODLP_tA0HpRDCszfG5OkCLe4-4_8LabqVRaLatg9Q4O51...

PA-200 Slow browsing with url filtering

Hi, a couple of questions on the matter: - to get URL reports i need URL Filter on the rule to be on . Is this correct? Or can i have url reports without that enabled?- with a PA200 with 1 computer connected, with URL fitler when i enter the website, it takes 4-5 seconds to show the page. without url filtering on the rule the page displays immed...

True test to verify dns sinkhole configuration is correct

Hi Team, We recently had a support case where a user followed all the guides on the kb and found that the sinkhole feature appeared to be not working. After a few quick tests we determined they had configured it correctly. The issue was the domains noted on some of the articles on the kb which used to be classed as malicious domains are no long...