General Topics

HA and stateless connections...

Ok, I have what may be a newbie type question, but it is one that I wanted to ask.In the PA 201 class, they teach for HA, that stateless connections are not synched.What is considered a stateless connection? I do not think it would be UDP traffic (although this comes to mind), but if I am running a audio or video call to the Internet, it is goi...

OSPF adjacency not forming when we create sub interfaces on Palo Alto

Hi my OSPF adjacency is not working when i enable with a sub interface but works with physical interface. Same is the case with QOS . Any help ?Attached screenshots for your reference

Resolved! Global Protect portal authentication with LDAP fails

We have set up GP to authenticate against an AD server . User group mapping has done and u can pull the users . However, whenever you try to connect with one of the users from the GP client or portal web page , you get authentication fails message . Connecting with local db works fine . Any ideas ? I saw an article about spaces in the authent...

Resolved! vwire policies

HI all,when we deploy the paloalto firewall in vwire mode and we have multiple zones (system zone, application zone, bdd zone), can we create rules to permit traffic between these zones through pan firewall ??thank's in advance

Palo alto starter questions

Hi,Iam a starter for paloalto .. I have few questions so any answers on this will be help full...What is dynamic block lists and how can we use that?What is disable server response inspection in a security policy?how to add virus exceptions based on threat ID , because we don't see any database unless we specify the threat IDWhat is Log containe...

Wildfire - Time required to block known malware

Using the 'free' Wildfire service, does anyone know how long should I expect the delay to be before downloads marked as malware are blocked subsequently?For example, today we had a download ("pdf_delta_ticket.scr" below) that was logged as upload-skip which to my knowledge means that it has been seen before by this device. As the last previous ...

Resolved! Panorama WildFire Reporting

Hello,I could not find any documentation on this inquiry. Is it possible in 5.0.x to get the Wildfire aggregation logs from all my PAN devices to the Pano log Monitor for central reporting? Thanks!Mike

Resolved! Skype IM Problem

Hi,I've some problems with skype instant messaging.Sometimes the messages are not sent.Checking firewall logs I see when messages are not sent an 'unknown-tcp' connection is denied.Same destination port (but different ip) were used and recognized before as 'skype' connectionFor exampleTime App From Src Port SourceRule...

Resolved! PAN-OS User-ID agent limits

I have found documentation that states that the UserID software agent can support up to 100 domain controllers and/or Exchange servers. Is this for both the standalone agent and the built-in agent on a 5.0 firewall. Or is there a smaller design limit for the built-in UserID agent? Can someone reference a document that explains this? Thanks

Resolved! User Activity Reports - No Data Available

Hi,I have inherited responsibility for our Palo Alto 2050 and am trying to run user activity reports. However, for the past week the reports have been showing "No Data Available". The only change made I am aware of was having the policy set to only log on session end however that has since been change back. Changes were committed. The policy is ...

Resolved! Mass migration of static routes

We need to migrated about 600 static routes into PA 5050. I want to do this quickly and efficiently . The goal is to copy all 600 routes and paste in the running config . Any idea how to do this ?

Traffic Report: How much destination hosts contacted

Hi Community!There is a predefined traffic report "Connections": It shows per row how much connections (sessions) a source host has made to a specific destination host. Is it possible to create a report which shows per row how much distinct destination hosts a source host has contacted? This could be useful for example to recognize if a source h...

Resolved! Panorama template is not working

Hi i created a template on panorama and tried to push to a device but each and everytime it says template name invalid.i tried more than a few combinations nothing works. Any help.Posted screenshot for reference.

Resolved! How to force Panorama to push out new configs in serial?

One of the admins mumbled today that when changing shared objects in Panorama and pushing out new configs he needed to do this one by one regarding managed devices.That is click on sync, wait until the text "out of sync" changes to "ok" (or whatever it says) and then click to sync the next device until all are synced.Is there no button to "sync ...

Resolved! How to get friendly name of a vsys into the syslogs?

I have followed the order described in to create a custom log format for use by a syslogserver which is much more happy of getting the logs with spacesas delimiter instead of the commas.However I noticed that the $vsys variable only gives out text like "vsys1" instead of the friendly name which is regulary used by the vsys in all configuration ...

Discussions

HA and stateless connections...

OSPF adjacency not forming when we create sub interfaces on Palo Alto