General Topics

Fuel User Group is Now Part of LIVEcommunity – Connect & Learn for Free

Hey Everyone!

The Fuel User Group is now part of LIVEcommunity! If you haven’t come across Fuel before, it’s a space where you can connect with fellow cybersecurity folk, share knowledge, and learn from each other. It’s completely free as well! Fue

...

Welcome to the General Topics Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating:

Rules and Best Practices

Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussion

...

Global Protect + LDAP + Cert Auth = Auth Fail AND Auth Success

Is anyone else running this setup...

Global Protect VPN(iPads specifically) using LDAP(Active Directory) AND client certificate for authentication.

...if you are, have you noticed in the System logs, when a user authenticates to Global Protect the PA l

...

Resolved! SMTP long MAIL anomaly Vulnerability(30392)

The description says "This signature detects an anomaly in SMTP protocol. It would trigger when anoverlong mail command argument is passed to MAIL command."

Can anyone elaborate on this definition or know where I can access more detailed information a

...

Resolved! IPSec-ESP No matching record

The last few weeks I have noticed a large amount of traffic on the Network Monitor coming from IPSec-ESP. I moved several VPN tunnels off our old WatchGuard to our Palo Alto PA-3020 around the time this started. When I click on the application itse

...

Resolved! PAN-OS upgrade from version 5.09 to 6.0.1

Hey,

could you please, tell me the upgrade steps required to upgrade from Pan-os 5.0.9 to 6.0.1 in Active/Active VWire mode.

Regards,

Warning: running 6.0.4 policies with multiple tags

Version 6.0.4

Tested in 3000, and 5000 series

Tags disappear, if edit any objects using webui clicking on rule name while multiple tags in security policies.

Bug# 67259

Encrypted Traffic over the Palo Alto

We have site to site VPN (both side PA) in our network, I want to send some encrypted traffic over the tunnel , How the palo alto will decide the encrypted traffic not to be scanned (threats) and filtering rule also not applied for the those traffic.

...

Fan RPM defaults for a 3020

I recently purchased a PA-3020 and just fired it up for the first time. The first thing I have noticed is how loud this device is. It is almost deafening and can be heard in the hallways behind a door in my server room. Is this typical behavior?

...

Dual ISP

My main PA is configured for dual ISP's and I am going to put third party certs for my global protect clients. Do I put two certs on? One for each ISP?

Resolved! Help With Custom Datafield or Vulnerability

I have a Snort rule for a specific network activity I wish to either block or alert on. I would like to translate this into a PAN. Would it be best to do a data field or a vulnerability?

alert tcp any any -> any any (content:"|6E|"; depth: 1; content:

...

Use VM-100 With Could Provider - MAC Issues

We are trying to set up a VM-100 as the entry point to a virtual data center. We have run into an issue with the MAC addresses on the VM device not matching the MAC addresses on the Palo interfaces. We appear to be stuck at this point. Apparently it

...

API test url category

I want to use the API to query URL (Brightcloud) categorisation. This is the command in the CLI:

pan1(active)> test url theguardian.com

theguardian.com news-and-media (Base db)

running the same check via the API browser:

https://x.x.x.x/api/?REST_API_TO

...

Resolved! File blocking profile for Evernote application

Looking for a custom file blocking signature to block uploads within the Evernote client application.

Resolved! Public IPv6 DHCP Support

Since many ISPs are adding support for IPv6, I wanted to know if PAN firewalls support receiving an IPv6 via DHCP from the ISP? When I go to IPv6 on the interface, I don't see a DHCP or PPPoE option. It appears one can only set a static address ?

User IP-user-mapping incorrect

(PA3000 series FW running 6.0.2) Getting users being blocked by the captive portal from a local service account running on their machine.. only way around it is to disable the service and/or account and then flush the user to ip mapping cache. Any w

...

VRFs on a Palo Alto - can it displace a Cisco ASR router?

Hello, we recently purchased a pair of PA-3020s to run HA with and replace a pair of ASA's. Think we've mostly got them configured to replace the ASAs with the assistance of the reseller's engineer and so far, so good - everything is working great.

H

...

General Topics

Discussions

Fuel User Group is Now Part of LIVEcommunity – Connect & Learn for Free