General Topics

Suspicious DNS Query's

Hello,We are running version 5.0.6 for a few weeks now and looks very good.We see now also in our threat detection the following threat "Suspicious DNS Query : ......" and this is blocked.This is very cool to block at dns level spyware and malware but the disadvantage of this is that the source client ip address is always your DNS server.So you ...

Cant login to PA-VM300 via ssh or HTTPS

Can anyone help me here.. I recently installed a PA-VM300 and all efforts to login via https/ssh has proved abortive. I had to work my way via CLI to connect via http. Also everytime i click on commit on the PA-VM300, I get logged off , and always need to re-login? anyone experienced this?Olu

Resolved! Can I look ACC of some devices in Panorama?

HelloThere are Device-A , Device-B and Device-C FWs.All FWs forward all logs to Panorama.I want to look ACC included only Device-A and Device-B in Panorama.Is it possible?Thanks

Resolved! Client certificate and LDAP authenticate on Global Protect

HelloI have a question.My customer want to use Global Protect.He want 2-factor authentication.User authentication client certificate on 1-factor.And then user authentication ID/PW to Active Directory by LDAP on 2-factor.I have searched and seen below."We're not using another form of authentication" on page 7 in this DOC.Can Global Protect use bo...

Resolved! Are there way that fw forward url & data filtering logs to ESM system by syslog??

Hello,I know there are not log type of url & data filtering on syslog server profile.But my customer want to receive two logs to ESM system by syslog.Are there ways?Please let me know it if there are.And I have a question.Panorama is received this logs(url , data) from FW.Why is it able to receive?Thanks.

Resolved! Help setting up internet connection

Hi thereWe're in the process of cutting over to a new internet connection and I'm trying to get our PA 2050 configured to handle to new IP range but I'm a bit stuck. We've been assigned the 111.69.54.112/28 subnet with 111.69.54.113 being the default gateway.Currently I've set the external interface to 111.69.54.112/28 and configured a virtual r...

Log Type Unknown

How do I figure out what the log type I have is when its showing me "unknown" for the current type?*edit* Sorry they are assumed for the IDS/IPS

Global Protect Welcome Page with ActiveX

Hi Guys,is it possible to customize the welcome page of Global Protect with ActiveX scripts? I need this to run Active Directory login scripts automtically after a connect with Global Protect.CheersDirk

GlobalProtect client pre-/post-connect commands?

Hello,Do someone know, if i can set pre- or post-connect commands at the GlobalProtect client?Background:i want to start a service after a successful VPN connect via DOS command (sc.exe).thanksregardsRobert

Global Protect too many outstanding keep alive

Hello guy'sdid Someone see this kind off message in global protect agent log on windows device.message :too many outstanding keep aliveand just after this message a logout is innitiated the VPN session is mount conntected and after less than 2 min a lougout occured.very strange situation with the 12.4 global protect agent and 5.0.5 PANOS on PA500.

Resolved! PAN as an explicit proxy?

Hi all,I have a simple question, is it possible to make my PA-3020 work like an explicit proxy ?I configured URL Filtering and I would like to adress web requests to the PA-3020 just like if it was a real explicit proxy...Many thanks in advance.Rudy

Is there a possibility of Palo Alto releasing rule content, similar to the way Sourcefire/Snort handle IDS rules?

We have Palo Alto appliances and we have Sourcefire IDS appliances running side by side in various configurations at work. I can't emphasize enough how convenient it is to be able to have an IDS event fire off from our Sourcefire boxes, and when I drill into the event I can actually see the rule that was written that matched on the event.In my e...

Alarm on device

Hi, We've did a little bit of testing on Palo Alto device and kind of want to know something about Alarm that we still can't produce the issues such as - At what temperature or percent that device will generate an Alarm - At what percent of CPU usage that device will generate an Alarm (both management plane and ...

Resolved! virtual-wire ARP issue

hi!i have a topology of 2 cisco routers connected to e1/1 and e1/2 in a virtual-wire deployment. there is only 1 policy on the PA, permitting all traffic, and all VLANs are permitted through the v-wire.the problem is that when i try to ping from R1 to R2 through the PA, the ping fails, and i do not get the MAC address of the destination interfac...

Resolved! empty user list

Hi,Device stopped to take user information from agent.Show user ip-user mapping all comes with 0 user.Passive device works fine.it shows all users.Agent connection is fine for both device.Any idea ?restarted user-id with debug command but did not solve.

Discussions