General Topics

Global Protect HTTPS weakness - Help!

Hi,I would really like an answer to this considering this is supposed to be a security product in the first place and I see several people have already asked the question.We have just had a security audit completed by a third party, they highlighted 2 issues with the address that our global protect portal and gateway reside on.SSL server accepts...

LSVPN configuration Question

In order to register with the LSVPN, each satellite must establish an SSL/TLS connection with the portal. Afterestablishing the connection, the portal authenticates the satellite device to ensure that is authorized to join theLSVPN..Just want to understand what exactly packet exchange they do when satellite office authenticates with portal and g...

Resolved! Global Protect before login

This may have been posted before but I am not finding the answer with my searches. I have a single Global Protect Gateway setup with a split tunnel configuration. I found a tech note for how to setup both a split and full tunnel on the same gateway but I was wondering if we could force the client computer to connect prior to the windows login ...

GlobalProtect Welcome Page for network links

I have been testing out using the Welcome page for the Global Protect client as a landing page for network links. The old appliance had a user friendly set of links for the average user. Right now the basic web links for email or www pages work fine. I have two types of links that don't seem to work though. Any ideas?Code:<a href="file:/...

Resolved! SNMP notifications - some missing?

I have enabled SNMP notifications on threats greater than or equal to severity "medium". Under monitor > threats I am seeing my alerts, but I only receive (via SNMP) some of the threats that shows up on the PA interface. Here is an example:I am only receiving SNMP alarms on the "SCAN: Host Sweeps", but not the spyware or the virus.Is this bec...

Log Question - Key Exchange

We randomly seem to get some alerts that say:SYSTEM ALERT : high : error: Key exchange failed in SSH handshake - DH key I'm new to Palo Alto firewalls and was just curious if this is something that can be ignored? Was thinking that this might be the result of just some networking issue this to fail and generate this alert.

About other ip flood in dos protection.

Hello.I have a question about other ip flood in dos protection.Is other ip flood all protocol excepted TCP , UDP and ICMP?I want to know protecting ack flood.Thanks and Regards.

Is it possible to Specifically Disable SSL 3.0 on a Palo Alto Interface

Hi All,I have a case where customer needs to disable SSL 3.0 on an interface and just use SSL 1.0 and 2.0 for both device management and GP. Is this possible? if so then how? Is there any other way apart from disabling the entire SSL feature on the interface? Kindly Advice

Resolved! Management profile issue

Hi Friends,please suggest, i have create a management profile (ping,ssh,https ) and apply e1/1 (static ip) but i am not able to ping and web access.Regards Satish

Global protect with AD integrated issue

Hi Friends,How are you. i hope you are doing well. i need one suggestion from you guys... One of the our customer using Global Protect Remote VPN with PACluster Gateway. they have integrated AD with PA deviceand GP users connecting through AD credential and now lots user credential needto change. So will itimpact when GP client connect with PA ...

Are there PA-7050 operation ressources?

Hi,I would like to know, whether there are already special resources for chassis operation? There seem to be separate logs for the cards. These special things seem not to be covered yet neither by the CLI Reference Guide nor by the Hardware Reference Guide. Questions are- Logfiles for cards- Power-Supplies- Chassis-Boot-Problems - Troubleshootin...

Incorrect catagory

Hi.....I have a url which is being blocked under malware-sites.I used the URL test site and it's in the travel category.http://www.therollingpin.com.auIn monitor, ocsp action is deny on the blocking outbound rule, I've removed ocsp application from the policy and allowed it in the respective policy of the staff member, but still blocked by block...

Is KVM live migration supported on VM?

Hi,Does anyone know, I was thinking that licensing may cause issues?CheersRichard

Best CPU allocation for VM-100

Hi,Say I have a KVM VM-100 (using SR-IOV) that I want to push 100Mbps of internet traffic through it, say you have 8 physical cores and for this VM-100 you choose to allocate 2400Mhz to it's VM, is it best to reserve:2 cores at 1200Mhz 3 cores at 800Mhz4 cores at 600MhzOr just setup X cores with no reservation and let the hypervisor adjust based...

Resolved! Threat Prevention inspection

Hey there,I've really been enjoying the Palo Alto ability to update itself with threats prevention signatures almost instantly (depending on ones setup)I've been checking the ACC more latly and have notice the following:I'll make some notes here:1) This is only appearing to user who are using the Global Protect to VPN into the corporate network....

Discussions

Global Protect HTTPS weakness - Help!