General Topics

Fuel Workshop - Watch Now: Managing Your Palo Alto Networks Assets and User Accounts

In case you missed it, check out this new Fuel Workshop series, which covers the following topics:

Customer Support Portal Overview
License Management
RMA Best Practices

Dive into the three-part Fuel Workshop video series and learn how to efficient

...

Ensuring a Safe and Secure Community: How You Can Help

Dear LIVEcommunity Members,

Ensuring a top-tier experience on LIVEcommunity and protecting our members’ safety and security is our top priority! To this end, we have implemented additional security measures to safeguard our vibrant global commun

...

Introducing the LIVEcommunity Support FAQ: Your Valuable Customer Resource

LIVEcommunity is thrilled to introduce its new Support FAQ section, designed to help Palo Alto Networks customers quickly resolve their common queries.

You'll find this new area under the Articles section of the main menu:

Our goal is simple:

...

Resolved! Secure LDAP Policy Rule Setup

Hello.

I am trying to setup an application policy rule to allow secure LDAP from our hosting company back to our internal domain controller running MS AD. I have the appropriate NAT statement setup.

If you look in the log screenshot above, you'll see

...

Resolved! User-ID Agent Errors on Domain Controllers

I'm getting the following error showing up in event viewer on our Windows domain controller. We have 4 DC total that have the the user-id agent installed.

As you can see, I am getting a lot of these error. The IP in question is one from our BYOD sub

...

SANS Institute - PAN Firewall Security Configuration Best Practice

Just wanted to let you know

https://www.sans.org/reading-room/whitepapers/auditing/palo-alto-firewall-security-configuration-benchmark-35777

Certificate failed to load

Hi all,

We have two PA-4060 in active/passive mode with PAN-OS 4.1.12 (I know, old..).

Yesterday, after rebooting passive device auto commit failed with:

Error: Certificate 'XYZ' failed to load: failed to parse key

and device went to not-ready state.

Afte

...

ISSUE WITH GLOBAL PROTECT

We have configured One VR-1 only

Ethernet 1/1 is a WAN interface

Ethernet 1/2 is a WAN interface

Ethernet 1/3 is a WAN interface

Ethernet 1/4 is a LAN interface

We’ve created

ETH1-ZONE for Ethernet 1/1

ETH2-ZONE for Ethernet 1/2

ETH3-ZONE for Ethernet 1/3

ET

...

Would Traps be able to detect and kill this file on the host without requiring any manual remediation?

A customer is seeing infected word files with macro in their network. The firewall is not able to block this file because the macro keeps changing file hash, even with WildFire enabled.

Would Traps be able to detect and kill this file on the host with

...

En modo mantenimiento no me deja hacerle un factory reset, me aparece typeerror: unpack-sequence

Traceback (most recent call last):vigate, ENTER=Select, ESC=Back

File "/usr/local/bin/mrt", line 192, in ?

main(sys.argv[1:])

File "/usr/local/bin/mrt", line 187, in main

m.main()

File "/usr/lib/python2.4/site-packages/mrt/ui.py", line 433

...

Can PA be possible for content inspection after ssh decryption?

Hello,

Can PA be possible for content inspection after ssh decryption?

I looked the below document.

Details on Port Forwarding Inside SSH

This document mentioned the following comment.

"Content and threat inspection is not done on the SSH tunnel session"

I

...

Resolved! How To Alert on IPSec Tunnel Down?

I have read about tunnel monitoring and DPD however is there any way to receive notifications when a tunnel goes down?

Resolved! Where is a check-box of Certificate for the Secure Web GUI option on PANOS-6.1.0 ?

Hello,

I am sure that a check-box of Certificate for the Secure Web GUI option show on PANOS-5.1.x

But it does not show on PANOS-6.1.0.

Where is a check-box of Certificate for the Secure Web GUI option on PANOS-6.1.0 ?

Please someone help me.

Thanks,

KC L

...

What happens if Dynamic Block List server is inaccessible?

If we are retrieving a list of IP's via Dynamic Block List to Allow and/or Deny traffic, what would happen if the web server hosting the .txt file is inaccessible during a refresh? Would the DBL object lose all of the IP addresses and render the rule

...

Issues with geolocation IP addresses

Hello,

We have policies (geolocation) which only allow connection from Spain and Andorra.

In many cases the IP addresses identified by geolocation, is not properly updated and sometimes Palo Alto identifies an IP like another country rather than as Spa

...

Resolved! How can I export my Applications list in a given profile.

I have a rather long list of allowed applications in a profile and want to export them for various reasons. I need to document them, and as I consolidate policies to a single on I don't want to add each one if I cam import them. Is there a CLI to j

...

Resolved! Problems with configuring Palo Alto PA-500 Firewall

Hi Guys,

I can connect via serial and console port from CLI to Firewall. But when i am trying to set ip for management interface i'm getting the following error

Server error : system -> authentication-profile 'LDAP Authentication Profile' is

not a vali

...

Active/Active HA on 7050

I'm getting ready to implement an Active/Active setup on a 7050. What is the best practice for bandwidth over the HA links? I'm more curious about the HA2 and HA3 links.

Discussions

Fuel Workshop - Watch Now: Managing Your Palo Alto Networks Assets and User Accounts

Ensuring a Safe and Secure Community: How You Can Help

Introducing the LIVEcommunity Support FAQ: Your Valuable Customer Resource

Resolved! Secure LDAP Policy Rule Setup

Resolved! User-ID Agent Errors on Domain Controllers

SANS Institute - PAN Firewall Security Configuration Best Practice

Certificate failed to load

ISSUE WITH GLOBAL PROTECT

Would Traps be able to detect and kill this file on the host without requiring any manual remediation?

En modo mantenimiento no me deja hacerle un factory reset, me aparece typeerror: unpack-sequence

Can PA be possible for content inspection after ssh decryption?

Resolved! How To Alert on IPSec Tunnel Down?

Resolved! Where is a check-box of Certificate for the Secure Web GUI option on PANOS-6.1.0 ?

What happens if Dynamic Block List server is inaccessible?

Issues with geolocation IP addresses

Resolved! How can I export my Applications list in a given profile.

Resolved! Problems with configuring Palo Alto PA-500 Firewall

Active/Active HA on 7050

PAN-OS logs

Turn off the firewalls in high availability mode and then turn them on.

Are there signature release for following vulnerabilities?

PA-440: Bottom Face Screw Mounting Footprint

using Subinterfaces in different Vsys inder same phy interfa

Re: New periodic alert: Configuration size 19MB is above 80% of the maximum recommended configuration size 23MB for the platform.

Re: sorting question

Re: How to add palo to multiple device groups

Re: New periodic alert: Configuration size 19MB is above 80% of the maximum recommended configuration size 23MB for the platform.

Re: receive incoming errors / 'rcv_fifo_overrun'

Unlock your full community experience!

Resolved! Secure LDAP Policy Rule Setup

Resolved! User-ID Agent Errors on Domain Controllers

Resolved! How To Alert on IPSec Tunnel Down?

Resolved! Where is a check-box of Certificate for the Secure Web GUI option on PANOS-6.1.0 ?

Resolved! How can I export my Applications list in a given profile.

Resolved! Problems with configuring Palo Alto PA-500 Firewall