General Topics

Pan Agent Clear clear user-cache all issue

Hello,I've an issue with a cluster of PA500 running PANOS 4.1.7.I'm using User Agent (release 4.1.5-1 installed on two 2008R2 servers) to authenticate users.When I clear the user cache (with the command 'clear user-cache all') on the firewall, the cache is NEVER populated again.All users are marked as 'unknown' in the output of the command 'show...

Resolved! Security Policy to block Dropbox

I have created a security policy to block Dropbox traffic, but so far it is not working. In my policy I have chosen:Source: Destination Zone: User: Destination Address: Application: Service: Action;trust untrust Me (as a test) d...

Resolved! Radius PSK limitation

Hello,Can somebody from paloalto give the limitation of the shared secret word size and characters that we can use in the RADIUS Server profile ?(I had some trouble to use complex secret with 64 characters with Windows 2K8R2 NPS))

Resolved! Multicast stream from one VR to another.

Hi,We have a IPTV multicast stream coming in on one of our virtual routers, and its working very well for all networks in this VR.However, when we try to "route" this multicast stream to another VR on the same box, we can't make it work.We have basically the same setup on this VR, except that we use "Remote Rendezvous Point" instead of the local...

VPN SSL & Linux

Hello,Here are some questions about VPN SSL Linux support :- When do you plan to provide a Linux SSL client ?- It would be great to not need the root privilege to be able to download and/or upgrade the VPN client.Thanks :smileycool:

Committing Firewall changes

Does committing firewall changes bring the firewall down or will it remain functional while updating the configuration. I basically want to know if I can commit a NAT policy change without bringing down my tunnels

Resolved! User identification

Hi,I´m trying to configure the User Identification based on LDAP to Win2K8 Domain Server.Apparently everything is fine - I can connect to AD Server and see the directory in User Identification -> Group Mapping Settings -> Group Map ProfileMy problem is that just groups are displayed, no users and no computers.I think that that maybe it is ...

Resolved! Wildcard/UCC SSL Certificates

Are there any issue(s) when using one of these for the reverse proxy (i.e. DMZ websites that use SSL) on the PAN please?Specifically thinking of using Digicert.

Slow Mac upload speeds while connected to Global Protect VPN client

Anyone else having this issue? I have tried from multiple machines. The download is fine but when uploading files back to our file share the speeds are "turtle" like. If I upload the same file using our FileVista web based file transfer it is 3 times as fast and it uploads to the same share.

Resolved! Threat log columns

Hi Everyone,I see two columns in the threat log that are "receive time" and "generate time". Is anyone knows what differents of them?Thanks,Joy,

Resolved! Accessing multiple network zones over IPSEC VPN

I am trying to setup a IPSEC tunnel between two PA-2020's, one on each side. I have the tunnel connecting and can access devices over the tunnel. However I am trying to access multiple network zones over the tunnel, and I am not sure how to configure that. I've typed up my setup below.Site-A (main site) has a 192.x.x.x/16 and a 10.10.x.x/16 ne...

'Unknown Error' on Commit of Network and Device Configuration

I am currently trying to find a way round the issue where by a commit causes a drop in the BGP connections that are peered with the firewall.During the testing upgraded to 4.1 to use the gradual commit but if i try and install just the Network and Device configuration from the advanced option in the commit it get the attached error - not very de...

IPsec VPN Tunnel with overlapping subnets.

Hi,Has anyone setup two PAN FW point to point that connect with the same subnets on each side. The reason for the same subnets is that we have our production network behind FW-A and a co-location network that mirrors our production network behind FW-B. This is for disaster recovery and quick turn on of machines in the event of a disaster, etc....

rate-limiting qos policy

Hi,I'm interested in creating a simple qos policy, which will rate-limit streaming applications for all users, except a group of power users.I'm assuming that I would have to create two QOS rules (policies).First one will assign streaming traffic for power users (source user = power users). In this case I would probably omit class, so that the d...

Resolved! Unusual Log entry

In the monitor tab, I'm seeing entries as sys1+[zone Name] in both the "from zone" and the "to zone" columns. What could this mean?

Discussions

Pan Agent Clear clear user-cache all issue