General Topics

Resolved! APP-ID detection capabilities in IP64 tunnels

Hi, I placed a PAN device in VWIRE mode on the WAN side of a internet connection. I planned to test the APP-ID capabilities of detecting IP64 tunnels. Over this WAN link, a 6-4 tunnel exists with Hurricane tunnel-brooker. The APP-ID is able to detect the 6-4 tunnel and identifies it as IPV6 application. But when a native IPv6 client is surfing t...

Resolved! NAT Translation to web server in 4.1.2 when WAN in DHCP Client

Hello,I have a PA-500 and need to setup some NAT Translation so external users can access some internal web and VMware View Servers in my lab.Since my Ethernet1/1 (WAN) has to be setup as a DHCP Client, what do I use in the "Originating Packet" - "Destination Address"?I was able to trick it by creating an address entry and specifying the IP I cu...

Resolved! Panorama multiple interface

Hello,I would like to know if it's possible to configure multiple ip interface on the panorama server ?One interface to administer the server, and another one for communication with the PANs .Regards,

IPS - set up packet logging

Dears,I would like to know if there is a possibility to collect some packets before and after the packet that trigged the attack signatureit will be helpful in case of troubleshooting and confirm if this attack is a false positive or real attack( knowing that this option is available from other vendors )Thanks and regardsSamir.

Resolved! PA 2050 device cannot boot

Hidevice cannot boot and waiting below mode******************************************************Autoboot to default partition in 5 seconds. Enter 'maint' to boot to maint partition.size: 7208960, sector_size: 131072Scanning JFFS2 FS: . done.Full fpga programming SUCCESSUnknown command 'fsload' - try 'help'## No elf image at address 0x200...

SNMP/QoS Questions

I had recently configured a Cacti server to monitor my bandwidth usage of my PA-500. All was working fine for a few weeks until I worked with support to configure and enable QoS to monitor bandwidth on the PA-500 without actually implementing QoS. Since then my Cacti server is not displaying the SNMP information it was receiving from the PA-50...

Configuring the firewall time-out values for HTTP(S) requests to the Exchange Server Microsoft-Server-ActiveSync virtual directory

I have getting 1040 event id on the Exchange 2010 CAS server. Event details as exampled below.Log Name: ApplicationSource: MSExchange ActiveSyncEvent ID: 1040Level: WarningUser: N/AKeywords: ClassicDescription:The average of the most recent heartbeat intervals [526] for request [Sync] used by clients is less than or equal to [540]. Make sure tha...

Resolved! loosing link between an user and is AD groups

I opened a case in this regard, but in the meantime I would like to know if anyone has the same problem as me.-I'm using version 4.1.8 of PA, the PA-2050 appliance.-User ID agent v.4.1.4.3 is use for authen users.- ad windows, on server 2008, for LDAP.I regularly lose the link between a user and the group associated with that user.Result: I have...

report top websites export to PDF: host name not resolv

When i doing a custom report, using template : Top WebSites, then I export report to PDF, hostname show IP instead of real host name.I use PA 4.1.9 .Any clue on that?There is a way to show real hostname ? Or maybe i can use URL filtering database instead of traffic?

Palo Alto and Duplicate Packets

How does Palo Alto handle Duplicate Packets? In our scenario, we have one interface running in TAP mode. We are using a port aggregator to shove spans/taps from multiple locations in our network to this one TAP mode interface. Doing this, the PA should be receiving duplicate packets when the stream of data flows past 2(or more) of the spans/ta...

Resolved! Limit Shared Objects

I have 8 5060s that I manage with Panorama, I share objects between all of these devices. I want to add a new pair of devices to Panorama that are completely separate from the other 8 and I don't want the shared objects to be on the new pair. I also want to prevent admins of the new pair from creating shared objects that will become part of th...

Resolved! Global Protect 1.2.0

Hi,I was trying to find if GP 1.2.0 is supported on 4.1.x releases. I can't find it in the release notes from GP nor PANOS. The GP 1.2.0 is shown in the list on the 4.1.x device and you can download it but is it supported?Is it available in different languages?Regards,Kevin

Control outgoing per user with 2 ISP

Hello all!Newbie here on PA-500 (just installed yesterday ), PAN-OS 5I have 2 Internet provider connected to my PA-500 (configured and initial set-up done by reseller), and I am looking in a way to control (by user or device IP) who could go out via ISP2/Untrust2, in other words, not everyone going out by the "default" ISP1/Untrust1 interface.T...

Resolved! Unable to access PA-500 via GUI/SSH on v4.1.7

Greetings,I have a pair of PA-500s running HA version 4.1.7. The web interface (GUI) and SSH access to active device was lost for some unknown reason. The only configuration change done was to set action for a security rule to deny which otherwise was allow. The changes were committed and firewall was good enough for the next 90mins. After 9...

Resolved! Captive Portal Session Timeout

You can set the Timeout value of captive portal. Default is 60 min. In my case it is 240 min.But this is the max TTL. There is a default TTL of 900 sec(15min)So when a logged on user does not create any traffic for 15 min then the user must logon again.IP dent. By User TTL (s...

Discussions

Resolved! APP-ID detection capabilities in IP64 tunnels