General Topics

Discover LIVEcommunity Through Our New Animated Explainer Video!

We’re thrilled to unveil a brand-new animated video that highlights everything LIVEcommunity has to offer! This short and engaging video gives you a quick tour of the many resources available in our vibrant community — from interactive discussions and customer journey guides to the Cyber Elite program and Member Spotlight features. Whether ...

Resolved! Unable to see traffic in the Monitor tab-->Traffic section under 'Logs'

Hi, We have setup Palo Alto Firewall version 7.0 virtual appliance. we have configured two networks ehernet1/1 (10.10.2.x/24) and ethernet1/2(10.10.3.x/24). We have created a policy to allow traffic between these two networks and are able to ping across the firewall and do data transfer between two machines however we do not see any trafffic und...

Panorama 7.1.2 > template validation error -> TEMPLATE1 is missing 'settings'

Even trying to do it via CLI it does the same. Originally it didn't even show that vsys1 was an available vsys after the settings default-vsys command until I tried to enter it once (which it didn't complain about). Compare to running config does not show any change to 'settings'. You cannot force commit the change either. admin@M100-01(primary-...

Agg Interface Subinterfaces over multiple vsys

Hi, I am working on multi-vsys (4) design with PA-7050 chassis. I would like to know if I can use aggregate interface over multiple vsys. I am thinking of using aggregate interface so that i can get link redundancy. The agg interface will have multiple sub-interfaces part of different vsys. Is it possible?

VPN users getting "password expires in 0 days" after upgrading to 7.0

Hi all,Today I upgraded our PA-500 from 6.1.4 to 7.0.0.After the reboot, when I log in with the GlobalProtect client, I receive the following message in red in the warnings/errors section:"Password expires in 0 days."We authenticate our VPN users to an AD domain using LDAP. The AD accounts are set to "password never expires".I looked at the LDAP...

Custom System Event ID Severity

I would like to set the severity of the vpn tunnel-status-up event to critical so that it triggers an email without having to get emails for all informational notifications. Does anyone know if this is a possibilty as it currently sits?

Resolved! Aggregate two physical ports and share amongst multiple VSYS?

We have an old fashioned flat network layout. We are looking at a significant network redesign and part of that is doing a proper security architecture and separating our servers from our userbase and separating server tiers (e.g. web, application, database) from each other. We also are a government that has several different verticals (e.g. h...

Content Update 592 False Positive

I've noticed that since the 592 content update I've been recieving a large amount of Microsoft SMB Client Response Parsing Vulnerability alerts from Threat-ID 35427. I've checked the servers and the workstations and everything is up-to-date or not running an operating system that would have even included this particular CVE (2010-0476). Particul...

Resolved! PA-3020 L2/VW Config Help

Hello, I just recently purchased a pair of PA-3020’s and I am having some trouble with Layer 2 / Virtual Wire interfaces. I am trying to create a network with multiple segments for both servers and workstations. I will have several “standard” segments using layer 3 interfaces and virtual routers with private addressing and NAT but I also wanted ...

show interface logs status by date

Hello, How do I verify if an interface status changed by date and time? Example: I would like to know if Ethernet1/10 went down last week or 2 days ago at a 10:00 am. Thanks for any help.

Resolved! Palo Alto high latency on the external interface

Hi All, What could be the reason fro high latency on the Palo interface and why do l have the same hop multiple times, in fact, 4 times? C:\Users\admim>tracert 1x3.2x0.x5.x4 Tracing route to 1x3.2x0.x5.x4 over a maximum of 30 hops1 1 ms <1 ms <1 ms vpn_firewall [192.168.1.200]2 1 ms <1 ms <1 ms 1x5.11x.1x1.1x13 4 ms 4 ms 4 ms 1x4....

Resolved! Anyconnect to Palo VPN

I am beginning a Cisco Anyconnect to GlobalProtect migration. Has anyone tried to connect AnyConnect to Palo. I can't find any docs on it and have been able to find a good link on how it is done. It would help our migration if we could connect the Cisco client to our new Palo firewalls. Thanks

Resolved! Palo Alto PA-3050 100 % CPU

These were upgraded from 7.0.6 to 7.1.2 on 31 May. Since then we are suffering from the data plane very frequently using 100% CPU. For example: admin@PA-3050-5(active)> show running resource-monitor hour Resource monitoring sampling data (per hour): CPU load (%) during last 24 hours: core 0 1 2 3 4 5 ...

Logs from the CLI

We've had suspicions that there have been logins from an unknown source via the console. "User admin logged in via CLI from Console" None of the team have stated they logged in around 1am to the box, and the room is locked with a pin. Is there anyway, apart from comparing configurations, and seeing what admins have logged on (I only have one adm...

Resolved! Modified Vulnerability Signatures

Hello, On the last Threat and Content update on our Firewall, we suddenly started receiving alerts on our Firewall for a specific vulnerability (Threat ID 35427, CVE-2010-0476). Now this is an old CVE and upon checking the MS10-020 article, there was no update from Microsoft, but Palo Alto release notes suggested that this signature was modified...

Resolved! Choice of cert in SSL/TLS Service profile

I've imported a certificate into my Palo 3020 (7.0.2) successfully. However when i select the dropdown field for 'certificate' when creating an SSL/TLS service profile, my certificate is not listed. If i create a self signed cert from the Palo itself, that cert appears as a choice. Is there some format restriction on what kind of certificate c...