General Topics

SSL-VPN Portal not being displayed

Hello,we're running a couple of PA-500 v.3.1.5 in HA, with SSL VPN Client v.1.3.4.We're experiencing strange access issues to the VPN Portal depending on the browser being used.When trying to access the portal url we get a blank page with endless loading icon.This happens on Win7 64 with Firefox 28, while it works fine with IE9/10.On another sim...

GRE over ipsec

hello,I have an existing customer with an Cisco router. On this router is terminated a GRE over IPsec tunnel.Now they have bought an PA500 appliance. Is it possible to have the GRE over IPsec tunnel on PA, or the only way will be to reconfigure the tunnel to IPsec?thanks alotRudolf

PA-500/PA-20xx - tuning mgmt performance

Hi All,I`d like to start a discussion what we can do to improve the bad mgmtplane-performance (gui, commit times etc.) on the older platforms PA-500 and PA-20xx because there are still several customers out there with these devices and for the PA-500 there is still no new plattform (something like PA-1000) availble.Hardware:- RAM Upgrade: well...

Resolved! Upgrading from 5.0.11 to 6.0.0 fail

Hi Team,unfortunately, I tried to upgrade my 2050 from 5.0.11 to 6.0.0 with no luck I get the below error could you please help me to solve it

Error when trying to commit

Hello,I am getting the following error when trying to commit and am not sure where to look. Error: Need to config WMI account and password for querying Microsoft directory serversThanks in advance.Bob

VPN Encryption/Authentication key's for Wireshark Decryption

It is possible to debug ESP packet's in Wireshark but to do so I will need to obtain the encryption key and the authentication key for the given VPN from my Palo Alto 5050. As an example - In Linux it's possible to get this information by running the command 'ip xfrm state':gw205:/ # ip xfrm statesrc 192.168.140.200 dst 192.168.140.205 proto es...

Best or recommended way to connect PA to Windows Domain

What is the recommended way to connect a PA box to a windows domain?I see know there is a radius way of doing it, and i know this is the way other like to configure it.But there is alot more work configuring, and reconfiguring if i want to change/add any groups or access.Is there a reason we should not use Kerberos or LDAP?

Resolved! Comprehensive report

I have had my PA 3020 in line for about 4 months. Can anyone suggest a report to run that we give me a good over all idea of how well the firewall is working?

Heartbleed bug - filter status?

Anyone got some information regarding a threat filter release for CVE-2014-0160 a.k.a Heartbleed bug in OpenSSL?

youtube detection failure

creating security policy to allow specif users to use applications web-browsing and SSL with destination any with using SSL decryption policy which decrypt all.after this policy there is implicit deny .the issue that palo alto cant` detect youtube application , monitoring shows that is web-browsing is permitted and falsh is denied !!!!how i can...

User-ID Agent

hello.... Can a User-ID Agent connect to more than one firewall?if so, how do you set up the other ones?

Resolved! Active/Active & IPSec Trouble

After implementing HA Active/Active, we left S2S VPN tunnels alone. Ultimately no changes to IKE Gateways. The S2S terminate to a /30 address that is statically routed from the ISP to ethernet1/12 on the active-primary. Tunnel interfaces and their routes are identical on both primary and secondary, IKE Gateways are NOT synced as this is just ...

Resolved! Port Channel to Cisco Switch

Hi,I have Palo Alto 3020/5020 firewalls and I would like to configure a port channel (ether channel) between these devices and a Cisco switch.I have configured an aggregate link on the Palo and added the interfaces. I have created the Port Channel on my Cisco but I am not seeing the AE interface coming up.Has anyone got a guide on how this can b...

enforce safe search

I created a rule for URL and tick the enforce safe search. When it enabled, if I want to do the google search, I have to log in my account and pick lock safe search. Otherwise, it will block me. I think it is hard to use in my case, which is a school and have lots of students around 5-6 years. it is too hard for them to do register a google ac...