Using Global Protect Internally - Several Questions

I am fairly new to the world of Palo Alto, so I apologize if this is answered elsewhere. My team is looking at an implementation scenario, and I have several questions as a result. I figured this community would be the best place to start.

We are c

ICMP Output

I'm getting odd ICMP output when I try to ping from the untrust interface to a location on the internet. The ping is successful but there is additional output.

Has anyone seen this before?

fw> ping source x.x.x.x host 8.8.8.8
PING 8.8.8.8 (8.8.8.8)

Using wildcard pattern/ regex in URL filter

Hello,

I like to exclude subdomains from decryption. Therefore I've created a URL category. But I don't like to exlude all subdomains only specific subdomains.

For example: I like to exlude domains starting with "whatsapp" and ending with "facebo

IP confilicting error

Hi We have configured HA pair on our two PA-VM200 Palo alto firewall. Now IP address of my interfaces eth1/1 (inside 10.1.1.1) and eth1/2 ( out side 10.1.1.2) are showing same as primary 10.1.1.1 on both firewalls and I am getting IP confilicting ...

User-ID Agent Windows 2003 logon events

Hi all,

I sometimes have a really hard life mapping domain users with old Windows 2003 forests using UID Agent (no matter if version 6 or 7))

I'll try to explain: when and only when using UID Agent I cannot read all users logon events or, worse, I ca

GlobalProtect - PW Prompt when LDAP Auth is down.

Hi all,

I tried support on this, didn't get much help.  I am using PANOS 7.0 and GlobalProtect 2.2.1

I have a couple hundred GlobalProtect clients using Windows.  I am using pre-logon (always on) with LDAP authentication.  The goal is to

Dual NIC - IP Mapping Issue

This appears to happen at random to a random subset of users.

Environment:

> 160 AD DCs

4x UIAs (2 - 80 DCs / 2 - other 80 DCs)

Assume:

All possible DCs that a user would authenticate to are being monitored by the agents.

Scenario:

When users with laptops c

Auto upgrade on OS

It looks like an upgrade for the os comes out about every other month, has anyone come up with a way to automate the upgrade process and can you recieve email notification of when new os's come out

How many can PA-3050 create and/or conditions in a custom signature?

Hello,

I have a quesiton.

How many can PA-3050 create and/or conditions in a custom signature?

I mean what maximum numbers of and/or condition a customer signaure have.

Thanks,

KC Lee

Detecting encoded C2 Communication

Does anyone have experience detecting C2 communication that is encoded?  I've been working with some malware that communicates back with base64 encoded blobs inside (legit looking) http traffic.  I'd like to be able to decode the base64 text within t

nsatc.net shows as spyware?

I have a ton of entries in my spyware logs for DNS attempts to nsatc.net

Some digging suggests this is a site run by Microsoft related to Windows Updates.

False positive?