General Topics

Discover LIVEcommunity Through Our New Animated Explainer Video!

We’re thrilled to unveil a brand-new animated video that highlights everything LIVEcommunity has to offer! This short and engaging video gives you a quick tour of the many resources available in our vibrant community — from interactive discussions and customer journey guides to the Cyber Elite program and Member Spotlight features. Whether ...

Monitoring - source user not shown in log

Although the "agentID client" is installed on one of our domain controller boxes, I find that when using MONITOR log to look at the traffic, it doesn't show the "source user" of whom is currently logged in via Active Directory. Any idea why?In addition, the monitor log will show the ip address and it will "resolve hostname" when checking the box...

Resolved! PA-500 IPsec VPN

Hi all,I have a general VPN tunnel question.. Was do the status lights on the IPsec tunnel indicate (see below)? I understand green is goo and red is bad, what I don't know is why is there two? I can surmise that the second one is the "IKE Gateway/Satelite" but what does that really mean? does that tell me that my phase one IKE settings are righ...

FAO: PAN. Brightcloud Server Down / Miscategorization of websites based on Dynamic dB on version 3955. Why??

Dear Palo Alto Networks,Off late, I have been seeing some bizzare issues with Brightcloud services version 3954 and 3955. As per what I could see under the system logs, on 09/10/12, the brightcloud server could not receive data and there was failure in retrieving data (in-spite of having all the network connections checked and were absolutely f...

Resolved! BGP in a cluster deployment

hi!I was wondering how to use BGP in a HA active/standby deployment? a common design with floating IP addresses (HSRP/VRRP like) is to use two additional switches to connect to two upstream ISPs so a link failure doesn't result in an active member takover within the cluster. can you please help me understanding how routing tables are synchronise...

Resolved! Site to site VPN issue

Folks.I have an issue with some site-to-site configurations that is bugging the cr*p out of me, and I thought I'd post it here.I run some site-to-site VPN's (Palo Alto to Cisco 887 routers) which come up fine, but which seem to defy *all* configuration with respect to IpSec SA lifetime.As far as I can tell, I've configured a 12 hour (43200 secon...

Resolved! Moving from Global Protect 1.1.6 -> 1.1.7

I believe moving away from 1.1.6 now requires a trusted certificate? I have about 600 remote users on 1.1.6.. trying to get to the latest rev (1.2.1) without any user interruption. I tested with our QA firerwall and I am getting certificate errors.. is there any detailed instructions on how to proceed?

Skype - Cannot add Contacts and Skype Home Page Unavailable

Greetings,I have come across an issue which is confusing me and I am running out of options to find a solution:PANOS version: 4.1.9User-ID agent : 4.1.3-2I had issues with ip-user mapping and group-mapping ever since I've upgraded to 4.1.9. Any new users post upgrade to staff group weren't being picked up by the firewall or User-ID agent. Thi...

Resolved! Maximum number of virtual wire on PA 500

Hi all, I try to found the suitable PAN model for support my environment. I design PAN to support 2 virtual wire and 1 NAT network. I'm not sure that PA 500 will support 2 virtual wire. I prefer throughput and session number that support by PA500. Thank youTU

Resolved! Security/App-ID Bypass?

Can someone within Palo Alto Networks comment on this video? This seems like it could be an easy attack vector...Palo Alto Networks Security Bypass - YouTube

Resolved! Maint partition is empty

Hello, I have two PA-2020 in an HA Active Passive scenario. Just looking around in my CLI, I noticed that the maint partition is empty on one of my nodes, but has an older 4.0.3 on the other node.Partition State Version--------------------------------------------------------------------------------sysroot0 REVERTABLE 4.1.7s...

Upgrading 4.07 to 4.1.2 in HA environment

The following change log may be useful to all of you wondering how an upgrade goes in an HA active-passive pair. It would be nice if PAN support were to put this into a tech note. Each step is essentially a check or an observation from top to bottom.2050 Firewall Upgrade 4.07 to 4.1.2 Log:Pre download of PAN-OS 4.1.0 and 4.1.2 to both unitsNo co...

Resolved! HA recovery advice after upgrading Active first

Being a newb and never having updated my Active/Passive HA pair, I took the 4.1.10 release notes at face value. There is no mention of special provisions for HA upgrades so I clicked "install" and now have a 4.1.10 Active member and a mismatched 4.1.7 passive member. Having now read the full product documentation I understand the "proper" way to...

Reports - i cant see source ip complete.

Hi,I have a PAN-2050 (Software version 4.1.5) and i have configured a predefined report with diferents tops (top 5 connections, top 5 destinations, top 5 applications). The problem is that when i dowload and see the PDF with the report i cant see the entire ip in the Top 5 connections and i dont know where i can do more bigger the field where th...

Agentless User-ID not processing ingore-user list

I've been working on trying to configure all the firewalls with the Agentless User-ID setup but despite several attempts to enable it I cannot get it to ignore users.I establish a session and enter config mode and type in the command set user-id-collector ignore-user [ domain\serviceaccount ] then commit the changes and despite doing so I still ...

Resolved! issue downloading release notes

I've been having issues downloading release notes regularly. The download doesn't even start, no matter if initiated from the support page or from the PA UI (Device-Software).Not a policy issue...Anyone else noticed that ?

Discussions

Discover LIVEcommunity Through Our New Animated Explainer Video!