General Topics

Some VPN packet is being dropped and particular counter increased and traffic slow.

Hello guys,I have a issue about the IPsecVPN tunnel. One side of IPsecVPN tunnel is slow for receiving traffic but opposite side is OK to receiving traffic.flow_tunnel_activate 2 0 info flow tunnel Number of packets that triggerred tunnel activationflow_tunnel_decap_err 47373 0 d...

Custom signature for Wordpress

I am fairly new to custom signature in Palo Alto, just so you are warned. I am trying to create a vulnerability signature for detecting wordpress. The Get request will contain /? followed by 5 digits or more. User agent will be wordpress/ followed by version number. My plan was to create one signature with one condition for User-agent ( http-r...

Resolved! Activate Brightcloud URL DB

Has anything changed with the way to activate Brightcloud URL filtering db in version 6? I updated several other boxes which use the pandb db and do not have issue.The one box in the wild we have with Brightcloud Url filtering is the only issue. It does not show as activated under Licenses (with no button to activate it). Its license is valid th...

Resolved! Active directory 2012 R2 integration with PAN os 5.0.9

Hi All,I've Palo Alto 5050 Active/Active Vwire deployment. the deployment was integrated with Active directory 2008 R2, but now I installed Active directory 2012 R2.but Palo Alto can't see the users in Acitve Directory 2012 R2.Any help about that please..Regards,

LAGG Interface Documentation

Is there any documentation about how to configure a LAGG interface in PAN-OS 6.0?I’ve read through the administrators guide, and did a search on the PA documentation web site, and I couldn’t find anything.Thank you!-- Rick

In my PAN firewall, I can see a lot of spyware detection in Monitor tab.

Hi,I can see a lot of spyware detected by PAN firewall. The threat is like- "Suspicious DNS Query (conficker:xtujyzyo.net)" .Does anybody knows about this kind of issue?

Resolved! Logging stopped in Pan OS GUI

Hi all,We had an issue today where we noticed the logging data stopped displaying in the Pan OS GUI (PA-500).. One thing we noticed is after committing a config change, it looks like the firewall was in the process of doing a sync with the backup device. I assume to resolve this problem we need to restart the dataplane? I'm surprised it allowed ...

Replace a panorama managed device with a new device (different model)

Hi All,We need to replace old PA2020 (PAN-OS 5.0.10) that is managed via Panorama (PAN-OS 6.0) with new PA3020.Referring to Panorama adminstrator guide 6.0, "How do I replace Panorama or a managed device in the event of a hadrware failure/RMA?"Questions:1) Can device state export from a PA2020 be import into PA3020 (new device)2) Should we use P...

Havex Malware

Hi all,Do you have any information about PAN detection capability for the Havex malware family: http://www.f-secure.com/weblog/archives/00002718.htmlThreat vault seems to produce no hits at the moment. Tuomo

Resolved! LAGG Interface Documentation

Hello,Is there any documentation about how to configure a LAGG interface in PAN-OS 6.0?I’ve read through the administrators guide, and did a search on the PA documentation web site, and I couldn’t find anything.Thank you,-- Rick

Resolved! Transitioning from Trial URL Filtering to Paid

I am currently using a trial of the URL filtering license and have made the purchase for the full license. Does anyone happen to know if it's a seamless transition from the expired trial to the full license with out any interruption? To initially enable the service I had to reboot my firewalls one at a time, It doesn't make sense that I'd have...

Split tunneling on iOS

Playing around with IPSec VPN on a PA-500 for my mobile users. On iOS, it's working fine with the built in IPSec VPN client, but split tunneling is not supported. I'm wondering if this feature is available if I use the GP client app instead of the built in client. Since it require a licence, I can't test it.

Commit fail error "Duplicate user name"

Hi. all..I Have a question about User-id.I am configured LDAP setting about PA-2050.(OS Version 4.1.9)Sometimes I saw the messages about commit fail error when I set up a user-id through security policy.The error message is "duplicate user name".I guess the problem is occurred when user's laptop used the wired and wireless connection to AD serv...

ipsec vpn issue

I configured ipsec vpn with palo alto to checkpoint.pinging isp:local/external ip(182.x.x.x) to peer ip(102.x.x.x) ping successful.pinging local network to peer ip:local pc(10.10.10.x) to peer ip(102.x.x.x) ping unsuccessful..tracert confirm drops on internet..ike not established(verified by show vpn ike-sa gateway)..following vpn troubleshootin...

Active/active ha config

Hi All,my req:isp 1 4mbps(untrust) ->pa 500a->(trust)cisco switch l3a->isp 2 4mbps(untrust)->pa 500b->(trust)cisco switch l3b-> same web servers but using isp 1 &2 public ip's(redundancy purpose) to do static s-nat for web servers external users should use both isp to reach web servers in active/active ha mode->load...

Discussions

Some VPN packet is being dropped and particular counter increased and traffic slow.