General Topics

Resolved! Static nat commit warning valid...?

When I commit my configuration, I am currently getting the following commit warning:· - Rule '<public ip removed>-snat' shadows rule '<public ip removed>-snat'I know why I am getting this and its because I have 2 bi-directional static source NATs with 2 different public IPs that go to the same internal IP. I understand that in the o...

Failing close..

I think Palo Alto refers to "Failing Close" as still allowing traffic through in the event of a failure. And by default, I think the Palo Alto 4020 Fails OPEN. Is there any way to set it to fail closed?We are using our Palo Alto as more of a sensor/monitor, not so much as a Firewall. We would like to put the Palo Alto inline with some parts o...

Resolved! URL filtering allow_list configure without URL license(BC-url database)

Hi all,We have try to configure the URL allow list in policy without the URL filtering license.but we fail because we just config the allow list.In URL filtering process execution1. black list2. allow list3. custom categories4. BC URL categoriesSo, if we just configure the allow list, another URL would not be control it because the database is e...

Resolved! High rate on "flow_host_ha_encap_err"

Hi folks,By chance (okay, we were troubleshooting another issue) we found a potentially strange issue on our active PA-2050 (there is a secondary (HA passive) PA-2050 in place as well).1) We issue the following command on the prompt: show counter global filter delta yes severity drop2) We get the following output:Global counters:Elapsed time sin...

Resolved! commit fail message deviceconfig -> setting -> custom-logo unexpected here

Hi All,I run a new PA-500 with PanOS-4.0.13, and when I do some testing and would like to commit, the commit fail and show the error message " deviceconfig -> setting -> custom-logo unexpected here".Is there any one know what the mean is?Thanks.Regards,Joy

Resolved! New Java vulnerability, CVE-2013-0422, released 1/11/13

Hello all,Just wondering if anyone might be able to tell me whether this vulnerability, CVE-2013-0422, is being addressed? And, if so, when could we expect to see a patch for this? Thank you!http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-0422&utm_source=dlvr.it&utm_medium=twhttp://msisac.cisecurity.org/advisories/2013/2013-006.cfm

Wildfire questions

Ran a very quick and dirty test with Wildfire using a few malicious files I could find online. 2 out of 8 of these were judged "benign" by Wildfire (the 2 that were missed were very similar, so 1 out of 7 may be more accurate). Anyway, I know that nothing like this is going to be perfect, so I'm not complaining about the false negatives.Question...

Resolved! What is the sysOID for PA5050/5060 used to distinguish different models

The following is assigned for the PA4020 & PA40504050: 1.3.6.1.4.1.25461.2.3.14020: 1.3.6.1.4.1.25461.2.3.2

Resolved! NAT to multiple https sites

It is possible to NAT to multiple internal https sites behind a single external IP address? If so any guidance on how to create the NAT policy would be most apprecaited.

PA-500 dual internet connections

Hello all,First post here!!I have a PA-500 that I'm trying to add a second internet connection to and I'm running into an issue. The goal here is to keep the primary line (a bonded T1 solution) for corperate traffic such as VPN tunnels, remote connectivity, SIP phones, mail delivery and then add the second line (a standard cable line) for genera...

Resolved! Block DMZ specific URL

Hi dear,I wanted to block from Internet a specific URL on our publicwebserver that located on our DMZ:We have a webserver on our DMZ example (https://toto.ourcompany.com) so we havea policy that allow from Internet to access this webserver by SSL, what I wantto do is to block only for example (https://toto.ourcompany.com/Web/login.html).I did a ...

Resolved! reserved address

Hi AllWhat's the max number of DHCP reserved address list?Bo

Routing to the same IP address via different tunnels.

routing the same IP within a VR via 2 different ipsec tunnels, I currently have a primary tunnel and a backup tunnel built for a customer. All traffic from this customer comes from the same PAT address to my firewall. I have 2 static routes going to the same IP addresses via 2 different tunnel interfaces using a metric of 1 for the primary and...

Resolved! intra-zone default

Hi,Do we have an option to disable default intrazone-allow policy which is hidden.thanks

How do you duplicate a device group

Mite seem like a simple question, but it seems you can only clone/duplicate the security rules within the same policy you cloned/copied it from. Im trying to create a new device group and use existing security rules from an existing device group without having to rewrite the same security rules in the new device group. Thank You.