General Topics

HSTS and HPKP "pinned certs" - breaks decryption and captive portal

I'm seeing many sites recently, like Google and Reddit for example, that are implementing HPKP, which prevents man-in-the-middle decryption like the PA. Currently, Chrome browsers completely ignore the PA certificate on these sites and use the site cert. Firefox just stops with a security message with no proceed or bypass, even when the PA root ...

How to get a list of all vulnerabilities of Threat Vault?

HelloDoes anyone know if it is possible get a list of all vulnerabilities Threat Vault?https://threatvault.paloaltonetworks.com/#I would like to get a list of all vulnerabilities and classify not only by severity.Thanks,dicu

Resolved! Global Protect Client settings

I Have configured Global protect and can successfully connect via clients. But after the initial instlal the users have to manually put in the port address along with their username and password.Is there a way to auto populate the portal address so the users do not need to know that info?

Security policies

Is there a good method to get and exported list of all the security policies on the PA without exporting the whole running configuration and in a format that is easy to read?

Resolved! Site-to-Site VPN question

I'm setting up a site-to-site VPN with static routes, which means the tunnel interface doesn’t need an IP address. But I would like to turn on tunnel monitoring and that does require an IP address on the tunnel interface. My question is does this IP need to be an actual publicly accessible IP or is it just two private IP's I define, both VPN pee...

View traffics in Mbits

Hi All, We want to view the traffics in Mbits/sec. We have configured QoS and see the traffics in realtime. Is there any traffics reports in Mbits?..In Graph, I see the traffics in Bytes. Please share any alternative ways..

Resolved! Custom report question

I have block/continue set on a URL category and I was looking to see if there is a custome report I could build that would show me the users that use the continue password I have set and for which URLs they accessed?

DirectPath I/O

I currently have a marathon support case open and support's latest reply includes an internal-only link (I'm pretty sure), so I can't read it. 😞 The release notes for 7.0 specify: "High Availability (HA) Link Monitoring is only supported on VMware ESXi installations that support DirectPath I/O." This is the only mention of DirectPath in the e...

Resolved! Siebel - on PA2020 v.5.0.11 - slow

Hello all,we have recently Siebel 7.8 which is behind the PA2020.The speed working on Siebel is so slow that in some requests freeze the clients.I created a test client which bypasses the PA and siebel runs perfectly.I created an application override with a custom application but the PA would not recognize the application and will not go through...

Global protect and HIP profiles problem

Hi, Lately I´ve been having issues with clients connecting to Global Protect. They pass the HIP match (no warning message is shown when they connect) but still the security policys with the HIP profile doesn´t apply, instead they hit a deny policy. After disconnecting and trying again for a couple of times it suddenly works and the appropriate s...

Resolved! Block Google Chrome Update

Hi Community, Is there a way to block Google Chrome update? There aren't any app, signature in the App-List. I've previously configured to block Firefox Update as the App signature in PA, and it was working fine. Did any of you had this need, or created custom app to disable Google Chrome Update? Kind Regards.

VWire and Oracle Database Traffic - Devs are complaining that its slow - Palo Alto 6.1.6

I was wondering if anyone in the community had any experience with implementing Oracle databases and Palo Alto in a VWire environment. Over the weekend we implemented a pair of Active/Active 5060's between the our data center and core. Every other application (AD, File Share, Print, VMWare View, Video, Voice, etc.) seems to be working as norma...

SSL Decryption, ¿hardware or software?

Hi, anybody knows if PA3020 and PA3050 has a dedicated hardware for SSL Decryption?. I saw a document a few years ago where you can see that some Palo Altos has a dedicated chip for SSL decryption but I could not find it again and I do not see if PA3020 and PA3050 has the hardware or not. Many thanks for your help Best regardsSamuel

Can we use HIP check for LAN users ?

Hi Team, Can we enable HIP check for LAN users? if yes, is it is limited to allowed Global protect client on each model? Regards,Guru

Resolved! Wildfire stopped working on PANOS 7.0.2

Hi All, Have an issue with WF wherein it has completely stopped working on PANOS 7.0.2.I have a ticket with 3rd party support and PA for this, just wondering if anyone has experience or knows the fix. Mgmt interface is service route for wf public cloud - i am registered://nickeo@chal-telehouse> show wildfire statusConnection info:Signature ve...

Discussions

HSTS and HPKP "pinned certs" - breaks decryption and captive portal