General Topics

NAT after Proxy

Hi I have to set up a PA-200 as a NAT. That it self would not be the problem but between the PA-200 and the modem is a Proxy. I have no information about that proxy. The only information i have about the network is the IP settings given by DHCP. Is it somehow possible to setup the NAT with just that information and no change to the existing net...

Resolved! How to block www.youtube.com completely

Dear All, Appreciate if you can advise how to block www.youtube.com completely. I have try using URL-Filtering and application layer level but still failed. I am using PA-3020 OS version 7.0.3 Imran

Resolved! arp not found

Yesterday I attempted to move our Internet connection from a copper interface on ethernet1/1 to fiber optic on ethernet 1/13 on a Palo Alto 3020. I ensured both interfaces were members of the same security zone and modified the Default route of default-vr to use ethernet 1/13 instead of 1/1. While I and the NOC technician confirmed the fiber p...

Resolved! Reduced bandwidth after 7.1.2 upgrade

After the upgrade to 7.1.2, I've notice that my bandwidth has reduced by 80% over a Metro E Gig connect. Any one else seen this problem or has a resolution for it?

Resolved! RADIUS authentication: MS-CHAP v2?

Currently, my PA-3050 devices (PAN-OS 6.1.12) utilize RADIUS authentication. I know that this uses the completely unencrypted PAP protocol. I have asked PAN about MS-CHAP v2 support in the past and was told that the device must be placed into FIPS mode in order to gain the ability to do RADIUS authentication over MS-CHAP v2, but by putting a de...

Multi AD Account login - Captive Portal

Hi, Can we limit the login per account using Active Directory as an authentication profile at Palo Alto Captive Portal? I believe by default, you can login using a single AD account with multiple devices.

Error with PDF Reports

when i do a test email for the email profile it successfully delivers the email. however in my system logs I get this error. "failed to email pdf reports to #####@#####.com for email profile #####" any ideas?

Resolved! User based ssl decryption

Hi, I try to test ssl forward proxy decryption. It works fine if I use IP address as a source but if I use Users(domain) as a source it doesn't work. I can't use IP's for testing because our IP's floating. What I need to check in configuration? Toni

Resolved! GlobalProtect 3.0.2 setting VPN DNS on WiFi adapter

Hi, I'm having a single client, running Windows 10 Pro, that we're having issues with.When the user connects to their network at home, they are unable to connect to VPN, and it seems like the issues is caused by GlobalProtect setting the WiFi adapter's DNS-address to that of the VPN proxy DNS. I have tried against mobile hotspots, and the same i...

Resolved! QOS & Aggregate Interfaces

Hello,In our QOS Aggregate Eth. Interfaces we cannot assign an egress value greater than 1000.(LACP Bundle is 2 x 1Gbit on eth4 + eth5)Why ?Do we throttle down throughput to 1 GBit/sec. in the Aggregate ?Shall we leave egress value in profile and Interfaces “0” ?no Feature description found in “in What's New in PAN-OS 7.0”

Resolved! Is there any restriction for application to add in Policy based forwarding

Is there any specific reason that all application is not avaialbe to add in policy based forwarding.For ex: I am trying to add "panorama" in policy based forwarding, it is not there.I have to addd port 3978 instead of application. Is there any reason behind this.

Resolved! Globalprotect client authenticate with a certificate not working anymore

Since we use our Palo Alto firewall, our users there Global Protect Client authenticate with the firewall through a certificate that is deployed thorugh Active Directory. Our Global Protect Client version is 3.0.2.Since we updated our Pan-Os version to 7.0.6 this method of authentication does not work anymore.THe client tries to authenticate and...

Slow download over decrypted TLS sessions?

I've noticed that downloads that occur over decrypted TLS sessions are incredibly slow since upgrading my PA-3050s to PAN-OS 6.1.x (now on version 6.1.12). Sometimes they don't even complete at all, either failing or just sitting forever. For example, I once tried to download a 70 MB file and it was sitting at about 18% complete seven hours la...

Resolved! RSH session issue passing through the Palo Alto

Hi Guys, Interesting one. 1x2.1x4.1x4.1x5 makes an initial connection using RSH the 192.168.0.20 then creates a separate RSH session back to the originating server but this always fails as the Palo seems to ignore the rule and NAT that is in place for this. Any suggestions/advises are welcome. Thanks

Brightcloud connection error

I have a PA-500 that is receiving the error of:opaque: Failed to connect to Brightcloud update server service.brightcloud.com, initiated by 192.168.75.30 eventid: connection-failureThere seems to be no connectivity issues to URLs for the users. Just this sys log being generated. The updates are set to every morning at 3:00am and work perfectly f...

Discussions

NAT after Proxy