General Topics

Problems with XFF cleaning

Dear all,we are getting more and more problems with the way PA handles the X-forwarded-for header.It is very useful in getting the internal client IP in a proxy environment. OTOH, you need to clean it before it goes out so that you don't leak internal IP addresses.This cleaning creates a problem.PA only replaces the content of the header with bl...

GlobalProtect: Pre-Login and user cert based auth?

Hi All, I've successfully configured pre-login and can enter my creds in to the GP client the first time I log in and it works great. Is there a way to use a user certificate for the user auth and avoid any action on the users part for auth? Desired configuration: 1. Pre-login with computer cert issued by my CA 2. When the user logs in, use ...

record reached max ression number

HiPls advise if we have CLI cmd that record the PA box reached max session number till now ...So I can assess if it will reach our session limited .ThanksJeff Jin

Resolved! Hardware Upgrade

Can anyone tell me the best way to upgrade from a HA pair of PA-2020's to new PA-3050's.

Resolved! Not working captive portal in https

Users report me problems, when they launch web-browser with a website in https, captive portal is not shown and they can not surf on internet, but if they go into http website the captive portal is working. why is not being showed the captive portal in https webs?

Resolved! What version is the best to decrypt and encrypt 6.1.x vs 7.0.x

Hello I need your feedback about what version in PANOS is the best to decrypt and encrypt ?. 6.1.x vs 7.0.x Best regards

Resolved! VPN connection problem

Good afternoon, When we are in an external network (for example wifi ) with IP range 10.10.XXX.XXX, and our computers are trying to connect to VPN, which has the same pool address 10.10.XXX.XXX, they can not. The connection is not established . GlobalProtect Portal uses as connection method "user-logon (Always ON)" and INTERNAL HOST DETECTION i...

Resolved! How is to work vsys instances?

I have two 5060 in cluster. I have new request to set up a 3 new vsys. So Currently these PA have the vsys1 by default, and I monitoring this PA via Nagios. My question is, When do I configure a multiple vsys, these vsys will be sending your own logs to syslog server ?. Best regards Andres

QoS on Aggregate (AE) interface

Hi, I am using PAN 7.0.3. I got two GigaE interface to form the AE Interface, however, I cannot set the Max Egress value more than 1000. And also, from the QoS Statistics and never seen the runtime bandwidth goes more than 1000. If so, it looks meaningless to us for the aggregaated interface to have 2GBps.

Issues with decrypt feature in the version 7.

Hello Could you share with me the main issues related to decrypt feature in the PANOS 7.? if has the number of bug will be great. Best regards Andres Padilla

Wildfire - email notification issues

Has anyone else experienced wildfire email notifications not being sent to all team members? Basically we have 3 team members who are all setup the same to recieve wildfire email notifications. One team member gets about 95% of the notficitions via email the other 2 team members only get 5% of the notifictions via email. This has been ongoing ...

Resolved! Does enabling Packet Capture on Security Profiles degrade system peformance?

Does enabling Packet Capture on Security Profiles degrade system peformance?The client has 3 5050's, one placed at each of 3 different sites. Are there any other costs or limitations assosicated with enabling this feature? Is single-packet or extended-capture preferred?Does Palo Alto have any best practices around this feature? Thanks.

Panorama logs missing beofre a date

Hi, We have 2 FWs sending logs to Panorama. We see the logs in Panorama after 3 January but not the logs previous this date. Why??? we havent done anything in Panotama for not to see this previous logs. Regards, JC

Time for URL category changes

Hi,Is the standard period for URL category changes approximately 1 business day? I thought this was the approximate turnaround however I have had 2 request exceed this time frame. Is there a fater method than using Palo Alto Networks URL Filtering - Test A Site or manual whitelisting? Thanks.- Tyrone Smith

Which are the prerequisites for Panorama 7.0.4 virtual machine?

Which are the prerequisites hardware for Panorama 7.0.4 virtual machine? We have always the CPU in 99%, with the process logd in 97%. Shoudld we put more CPUs and RAM to this VM??

Discussions

Problems with XFF cleaning

GlobalProtect: Pre-Login and user cert based auth?