General Topics

What's new in MineMeld 0.9.7

Release Date: 2016-03-24 How to update: Updating MineMeld Nodes - Miner for ProofPoint ET Pro feeds - Miner for PAN-OS syslog messages, let you extract indicators from PAN-OS logs according to a set of rules UI - now you can add a new static indicator directly from the NODES page or using the log-links feature of PAN-OS

Dataplane under severe load

We are getting this message in system logs. "Dataplane under severe load."

Monitor hits against captive portal?

When using user ID and captive portal, when an Auth attempt fails because of the captive portal, how can you get notified? We have spent hours troubleshooting broken apps because the captive portal was preventing access but we have no indication of the reason.

ISE syslog for UserID

I am trying to parse ISE RADIUS logs to help map wireless users to IP addresses. I have the Palo configured as follows but I am not getting any info from ISE. I am not that familiar with ISE and did not set up that end but have been told that ISE is sending the RADIUS Accounting logs to the management interface of the firewall. I I have User...

Resolved! Captive Portal with Vwire.

Why does below document advise we need a L3 interface for captive portal? We are running solely vwire and I still get on form when testing. I do have repsonse pages setup as well https://live.paloaltonetworks.com/t5/Configuration-Articles/Configuring-Captive-Portal-in-V-Wire-with-RADIUS-Authentication/ta-p/58143

Resolved! Two factor issues after upgrading to GlobalProtect 3.x

Hi, After doing an upgrade from GlobalProtect 2.3.4 to 3.0.1 we're having issues with users not being able to do two factor authentication in combination with SSO. The software we're running is SecurEnvoy, which has been working fine up to the client update. Firewalls are running PAN-OS 7.0.5-h2. SecurEnvoy responds as it should, and sends...

External CA Certificate Options Greyed Out

Hi guys, I've followed the documentation on how to generate a CSR (https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Generate-a-CSR-Certificate-Signing-Request-and-Import-the/ta-p/53593) but when importing the certificate I'm only able to select one option, as shown below. Could you please help explain why they're greyed...

Resolved! Correlated Events Action

Hello, How Palo Alto choose action for correlated events? For example we have several medium severity events with summary Host visited known malware URL. In some events action is alert and some events action is block-url.

Resolved! Hardware refresh HA pair of 2050's to 3020's

I need to refresh some 2050's HA pairs for 3020 HA pairs. This shoud be a pretty simple prcedure but I cannot find any instructions on how to perform this upgrade. Beside the fact 2050's don't have dedicated HA interfaces, are there any other gotcha's that spring to mind? In a nutshell, my plan was to bring the new pair into Panorama with th...

WAN Interface Not Registering MAC Address With Upstream L2 Switch

Hello folks, need some help here. After upgrading from 6.0.8 --> 6.1.0 --> 6.1.2, the WAN interface of the upgraded device, part of an HA-Pair in active-passive mode, does not register its MAC address with an upstream directly connected L2 switch. If I fail back over to the non-upgraded device, passing of traffic resumes as normal and th...

Unused Rules

There is a feature to highlight unused rules. If a rule goes from used to unused does that feature show it as unused and if so how long does it take to show it as unused?

Resolved! Testing SSL Decryption (Cant use eicar.org due to symantec)

Any sites other that eicar.org I can use to test SSL decrption and response page? Due to symantec on 2012 server cant test using that site. Any recommendations will help

Telnet from the firewall.

I dont see any telnet option on the firewall. Wanted to telnet mail.com port 25 just to check connectivity.

Resolved! Home configuration PA-200 help

Hi guys, Im new to this and im trying to install a pa-200 at home. I have managed to install it in a layer 2 configuration but i would like to install it now in a layer 3 configuration. I have followed this article https://live.paloaltonetworks.com/t5/Configuration-Articles/Setting-Up-the-PA-200-for-Home-and-Small-Office/ta-p/61838 but without...