General Topics

Discover LIVEcommunity Through Our New Animated Explainer Video!

We’re thrilled to unveil a brand-new animated video that highlights everything LIVEcommunity has to offer! This short and engaging video gives you a quick tour of the many resources available in our vibrant community — from interactive discussions and customer journey guides to the Cyber Elite program and Member Spotlight features. Whether ...

Security Policy's and NAT

Hi,I Have configured a BYOD wireless ssid that is being forced to the internet via a port on our 2050. I am trying to get the network to be able to contact our mail server for exchange on mobile devices and also to have access to our content server redirect page. Our internal IP address for the BYOD is in the 172.x.x.x range. I am NATing these i...

Resolved! 2 isp 2vr asymmetric

Hi,2VR 2isp,2 seperate default GW (2 ppoe modems)PC A ---- internet through ISP 1we want to RDP TO ISP2's public ip and make destination NAT to PC AHow can we make this work ?New enforce symmetric return did not work .commit fails with ppoe is not supported error.

Destination NAT/PAT clarification

Prior to shooting myself in the foot I want to make sure I'm on the right track.I have an application where I'd like to take inbound connections directed at a particular port on my untrusted "outside" FW interface and redirect them to the same port on an RFC1918-addressed host on my trusted "inside" interface. That is:OUTfirewall:47808 -> INr...

Resolved! Google Mail for Business

Hi all,Anyone has experience in using SSL decryption with Google Mail for Business? My concerns are the incoming emails will no longer go thru our mail content filtering engine and we don't have adequate tools to prevent data loss in outgoing mails (it's over SSL). This could be partially mitigated by using SSL decryption feature on the firewall...

Resolved! Question regarding ARP timeout

Hi,I have a question regarding ARP caching and timeout on the Palo Alto platform.Based on the output of the "show arp all" command, it looks as if the "default timeout" is 1800 seconds. I am doing some work with failover for a cluster inside my firewall, and I wanted to know if there was persistent ARP caching such that a different MAC address ...

Firewall is doing packet captures on it's own

Hi,I just noticed two traffic log entries that had packet captures attached. I didn't enable this anywhere, and just to make sure, I just went through the whole config (all profiles) to make sure I didn't enable it by accident. Are thre any circumstances in which the firewall would take pcaps on it's own?If not, what keyword should I grep for in...

Groups that the user belongs to

Hi,When we want to look at ip address of a user show user ip-user-mapping ip ........Groups that the user belongs to (used in policy) comes empty.I trieddebug user-id refresh group-mapping allAlso I can see all gorups on group mapping.

TS Agent on Citrix XenApp 6.0 farm

Hello,Our XenApp farm IP range is dynamic and the servers could spin up on any number of IPs within a couple of segments. Does a TS Agent entry for every single possible IP need to be added on the PAN device, or can I configure it to look at a subnet range? My attempts at using subnets have not worked, but single IP entries do work. Thanks!Mikes

Resolved! How does SSL inbound decryption work exactly?

I am not looking for a guide on how to configure it, there are plenty. What I want to know is how SSL inbound decryption works from an architectural point of view. In the docs it says that once you loaded the webserver's certificate onto the PAN device and enable inbound decryption, the traffic between client and server remains untouched. How is...

Radius Authentication

Hi,we use Vpn authentication for portal LDAP and for gateway RadiusUsers can connect using their names to portal with typing user and passwordafter that they type another user name and password for Radius.When we look we see the logs of users coming with username as just heir name.so policies are not working because policies are for users with d...

Resolved! Excel XLSX recognized as ZIP file

Hello,I configured a File Blocking profile to block specific file format (like Exe, PE, RAR, etc).Unfortunately, this profile also blocks Excel file in new format (.XLSX).No problem, with the old format (.XLS) !!After reading some doc, it seems that .XLSX is a compressed archive with a directory structure of XML text documents.How can I block ZI...

Resolved! Not Receiving Scheduled Reports

Kind stumped on this one. I have some scheduled reports I'm not receiving. I was getting them on a daily basis as configured in the email scheduler but they just stopped one day and no changes to the firewall were made. I've created a report group, an email scheduler, and email server profiles. Under the email scheduler, I've sent myself a test ...

Palo Alto as a route reflector

Hi,I have a couple of PA-500 clusters and I want to use them as route reflectors for my internal BGP network. There doesn't seem to be anything in the documentation on how to do this but the documentation suggests the Palo will do it, I was wondering if anyone here had got it working? So far I've configured the cluster ID and set the peer device...

Resolved! Some has a problem blocking Youtube Application?

I recently had problems with blocking youtube, I added a policy where I deny the application access to youtube. When I go to the YouTube page and I try to watch a video, the first time if it hangs correctly, but if I try more times with other videos, the application is no longer blocked and can see the videos on youtube.In the monitor tab, I see...

Resolved! DNS proxy policy

when you create a dns Proxy policy you declare only the ingress interfaceor egress interface ?

Discussions

Discover LIVEcommunity Through Our New Animated Explainer Video!