This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
General Topics
Post a discussion here if you have general questions regarding configuration and troubleshooting for Palo Alto Networks products. Use this forum to collaborate with like-minded security professionals to improve your security posture.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
General Topics
Post a discussion here if you have general questions regarding configuration and troubleshooting for Palo Alto Networks products. Use this forum to collaborate with like-minded security professionals to improve your security posture.
About General Topics
Post a discussion here if you have general questions regarding configuration and troubleshooting for Palo Alto Networks products. Use this forum to collaborate with like-minded security professionals to improve your security posture.

Discussions

Start a conversation

Deny the access to the servers in LAN zone

Hello, I need to restrict the access to a critical server in our company i the LAN zone . I add a security rule that restrict for exemple the address 192.18.1.25 to access to database server tht has the address 192.168.1.20 . I add a security rule from LAN to LAN with this address but the rstrection do't work! How can i do this restriction ? ...

RCHAIBI by • L2 Linker
  • 5125 Views
  • 6 replies
  • 0 Likes

How to Allow an App But Block a "Depends On?"

From what I understand, you need to explicitly allow "depends on" apps for a given app to work, https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Check-if-an-Application-Needs-Explicitly-Allowed/ta-p/61893 However, what if I want to only allow the "child" application, but not the parent? My example is "logmein." We explicitly...

cosx by • L2 Linker
  • 4496 Views
  • 2 replies
  • 0 Likes

Resolved! Eicar no longer in AV signatures?

Is Eicar testfile no longer blocked by PA? I've tried through 2 PA devices and on both occasions it arrived to endpoint station (where was blocked by endpoint AV). On 8th September 2015 same configuration was still blocking it. Yes, I am trying http version, I have AV on block etc.

santonic by • L6 Presenter
  • 5766 Views
  • 4 replies
  • 1 Likes

Aggregate Ethernet Trunked Traffic in a VWire

Hi Team, I was wondering if the below is acheivable. I plan to deploy vwires for this setup. Upstream switch's are Cisco switch's and same with downstream. (downstream switch's are stacked switch's - so logically one switch) The red is indicating one VLAN, like wise blue. We are planning to create an aggregate ethernet with sub-interfaces and...

Screen Shot 2015-10-17 at 15.45.02.png

Issues with SSL Inspection

Hi, I am having this weird issue where an application breaks because of SSL inspection. I have made an exclusion based on the certificate:ssl-exclude-cert [ login.salesforce.com *.salesforce.com ]; However, the firewall still decrypts the traffic, and it looks like it does when a different application is detected: This traffic is generated by ...

salesforce.JPG
MMCiobanu by • L3 Networker
  • 5760 Views
  • 6 replies
  • 0 Likes

PBF e-mail notification

Hello,Does anyone know if there's a way to have a notification e-mail sent when PBF kicks in? We had a hiccup on our Internet circuit and PBF worked flawlessy... so well though that I wasn't really aware of the circuit issue until the next day when I was troubleshooting something else related to the hiccup. There are probably a few different w...

dwoolley by • L1 Bithead
  • 4985 Views
  • 4 replies
  • 0 Likes

Resolved! PA-500 6.1.4 Policy and URL filtering

Hi, I have very big problem with my firewall. I have a few URL filtering rules which I block some of sites. Example: 1. Allow social network(linkedin) block youtube -> name AllowSN 2. Allow youtube block social network(linkedin) -> name AllowYT 3 and so on And I create for this URL filtering policies where specific users(by ldap) can ac...

ITBT by • L1 Bithead
  • 5467 Views
  • 8 replies
  • 0 Likes

PA 500 stop sending reports automatically by email

Hello, After upgrading two cluster of PA500 to 7.0.1, customized reports cannot be sent automatically using email.Using the 'Test send email' is working so it's not an issue with the config. The device stop sending the reports after 18 days... Regards, HA

licenselu by • L4 Transporter
  • 3749 Views
  • 4 replies
  • 0 Likes

VLAN with Palo Alto Networks PA-500

Hello, We need to set up a VLANS in the office with the PA-500 but we don't like to change our address. It's possible to configure a VLANs with MAC address or protocole with PA-500? Thanks

RCHAIBI by • L2 Linker
  • 8190 Views
  • 12 replies
  • 0 Likes

Custom Vulnerability Signature. Is this limitation correct or is a fail?

Hello I've been trying to create a custom vulnerability and I have encountered this limitation:Currently in Threat Database Vault 529 version there are 50 signatures for PHP. I'm trying to add all PHP signatures and this message appears when it exceeds 17 signatures. 😞Is this limitation correct or is a fail? 😞 A few days ago we suffer multipl...

vulnerability 41003.jpg
SIEM scan vulnerability.jpg
SOC_CSG by • L4 Transporter
  • 8343 Views
  • 5 replies
  • 0 Likes

Is it possible to configure dynamic load balancing using Routing protocols for below shown topology?

Hi All, Is it possible to configure dynamic load balancing using Routing protocols which are supported by PaloAlto?Requirement : We have total 16 MB line ( 8 MB from Aircel ISP and 8 MB rom TATA ISP ). We are looking to balance the load on both isp based on the traffic, means full 16 MB utilization at any given time fo...

Gururaj by • L4 Transporter
  • 4486 Views
  • 3 replies
  • 0 Likes

IPSec VPN issue

Hi All, We have configured IPSec VPN between PAN and AWS. When i iniate the tunnel, IPSec and IKE SA installed successfully as a initiator. then, IKE protocol IPSec SA delete message sent to peer. SPI:0x... After a second, IPSec key deleted. Deleted SA..... please suggest

Javith by • L3 Networker
  • 4560 Views
  • 6 replies
  • 0 Likes

HA Upgrade

I found this link on the knowledge base https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Upgrade-a-High-Availability-HA-Pair/ta-p/57081 Has anyone used this method or any other method that they would like to share. I am currently at 6.1.1 and sounds like its not a good idea to jump all the way to 7.0 but to do it in increments. Ca...

jdprovine by • L4 Transporter
  • 4300 Views
  • 3 replies
  • 0 Likes

Resolved! LDAP Server Update DHCP from GlobalProtect

Hi all, As you may know: When a client is connected on GlobalProtect, they are assigned a dynamic IPv4 Address, not static. In my situation, I have about 100 GlobalProtect clients. When the client connects for the first time, they are required to join my domain (i.e. www.contoso.com). My Domain Controller is behind my PA firewall. The ...

mmclimans by • L3 Networker
  • 2509 Views
  • 1 replies
  • 0 Likes
  • 24401 Posts
  • 123 Subscriptions
Top Solution Authors
View All
Labels
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks