General Topics

Discover LIVEcommunity Through Our New Animated Explainer Video!

We’re thrilled to unveil a brand-new animated video that highlights everything LIVEcommunity has to offer! This short and engaging video gives you a quick tour of the many resources available in our vibrant community — from interactive discussions and customer journey guides to the Cyber Elite program and Member Spotlight features. Whether ...

Resolved! help to configure a DMZ and NAT

hi,i need a little help to configure a DMZ. here is our situation:interfacesethernet1/1 - 1.1.1.1 (public - NAT clients)ethernet1/1.1 - 1.1.1.2 (public - NAT DMZ)ethernet1/1.2 - 1.1.1.3 (public)..ethernet1/6 - 10.10.30.1 (DMZ).ethernet1/8 - 10.10.20.1 (clients)routingdefault route 0.0.0.0 -> 1.1.1.1 (works!)NATclientOut dynamic-ip-and-port et...

Resolved! Aggregate Ethernet interface: LACP and PaGP support

Hello, Everybody,we would like to aggregate ethernet interfaces of our PA-5050 (4.1.7 PANOS) in order to have a redundant physical connection towards our Cisco Catalyst switches.Sound like LACP is not working with PAN and we had to set PaGP, which, on the other hand, cannot be configured to aggregate interfaces of different Catalyst switches, ev...

Resolved! Untagged sub-interface doesn't support in OSPF on v4.1.6.

Hello,Cause untagged sub-interface does not support in OSPF routing from v4.1.5. If I have that configuration usage in firmware before v4.1.5 (v4.1.1). What is the right way to configure OSPF area interface, if I want to keep IP address(subnet) of that sub-interface to be re-distributed in OSPF routing table?Now, I use Loopback sub-inteface inst...

I can't find this "BOT: TDSS.C Trojan Traffic Detected" in our threat db

Hi all,We found this threat"BOT: TDSS.C Trojan Traffic Detected" on 3rd party's IPS(McAfee) deivce,but i can't find this event on Paloalto Threat DB.Have anyone ever face same problem? Or have other solution can protect this attack ?Regards,Jim

Resolved! URL/Application Blocking

Hi Guys,Just wanna ask a few question. I was testing out the URL and Application Blocking. I was trying to block the facebook-chat, facebook-posting, etc.to cut the story, I want to block the applications inside facebook but not the whole website. sadly, it doesn't work.I can still chat post etc..so if you guys have something to say please let m...

HA email alert

hello guys,does email configuration on pan allow you to receive email alert when primary or secondary pan ( in HA-mode ) when the primary firewall goes down? or when any of them stop responding ?regards,bp

Nike Plus

I have a Palo Alto 2050, software version 4.1.6I have a user behind my Palo who can't log on to his Nike+ account. When he attempts to log on he gets redirected back to the sign on page continually. We've tested this outside the firewall and he has no problem. Anyone else seen this problemThank you,David Scott

Decryption

Does the PAN still inspect secured traffic for all threats if it's not decrypting it?

Creating user activity report with all the username in AD

Hi AllI am trying to create a report that will display all my users in my active directory and their activities, the current user activity report only allow a single user. I have also try using the custom report creation but there is no tab for users. anyone has any idea?

Authentication profile + Kerberos + group restrictions - should work?

Running 4.0.5 here.I setup SSL VPN a while ago, and setup an authentication profile to pull from our Active Directory via Kerberos. I have an AD group and I only want the members of that group (or members of groups that are children of that master group) to have VPN access.I only add that single group to the allow list, and nothing else.For som...

How to route internet traffic through a tunnel interface

What's the best way to route all internet traffic (except IPSec VPN tunnels) through a IPSec VPN tunnel interface?We want to have a single point where all internet traffic passes through and uses the same policies for web and applications.

Resolved! Panos 4.1 and new pan agent

Hİ i tried panos 4.1 and new agent(4.1-0-43) with active directory domain (but a way agent successfuly connect to active directory domain and showing active directory users)...i have trouble panos 4.1 when pa box try to connect pan agent i see below message on the pa box and connection unsuccessful but when i use the pan agent 3.1.2 with panos 4...

Resolved! Round Robin NAT?

Hello,I'm running PANOS 4.0.11 and I'd like to be able to set NAT to round robin between 2 servers in the DMZ. We would have a single public IP round robin NAT'd to two internal IPs. Is this possible on 4.0? How would I accomplish this?Thanks,Ian

syslog from PAM OS 3.1 to 4.1

Hi,I migrated our PAN FW from 3.1 to 4.1 and there is some more fields on TRAFFIC and THREAT syslog format.With 3.1, using syslog-ng, I got:Sep 27 00:00:35 giacometti-2 00: 00:35,0003C100873,TRAFFIC,end, etc ...Since by defualt in 4.1 there is more field than with 3.1 I'd like to customize the syslog format in a way that have the sames format as...

Resolved! Software Upgrade Question

When upgrading from PanOS 4.1.6 to 4.1.7, will the device fail over without issue as it installs the new software or will I have to schedule an outage? Thanks in advance.-Matt

Discussions

Discover LIVEcommunity Through Our New Animated Explainer Video!

Resolved! help to configure a DMZ and NAT

Resolved! Aggregate Ethernet interface: LACP and PaGP support

Resolved! Untagged sub-interface doesn't support in OSPF on v4.1.6.