General Topics

Resolved! How HA active/passive 2000 series works

Hi Guys ,I have a dubt about HA Active/passive How it`s works ? i need to have a float IP ?OR my 2 appliances need to have the same configuration ?I see some docs , but i don`t understand how HA works.So if somebody can help me I`m using 4.1.3 PAN-OS.Best Regards.Thiago Lima.

User ID agent / User-IP-Mapping issue

Hello,I have simple request: created access rule based by group.(and this part looks clear and working to me). Problem that i can make User-IP mapping to work correctly. With desktops i do not see any issues because their users do not change mostly at all. Major problem is with laptops. Users migrates between meeting rooms, use wifi and comes ba...

PA-2050 commit frustration

Hello,We have 2x PA-2050 devices in HA running 3.1.10 and I'm frustrating about commit time, it takes like 5-10 min.Can I expect significant improvement, commit time speaking, with upgrade to 4.1.5 ?Field experiences in commit time with 4.1.5 ?Or should I think about PA-4000 platform ?

Resolved! Delay in SSH prompt

Hi, All,I have a hopefully quick question regarding my Palo Alto 5050 firewall pair; whenever I go to log in via SSH, I get a delay of approximately 5-10 seconds before I am actually prompted for a password. Is this normal? This is more of a nuisance than anything causing a problem, however it is begining to bother me because I am logging into...

Monitor throughput of dataplane using snmp

Hi allis there a way to monitor the throughput of the dataplane? I would like to turn on threat protection on my Palo's but I need to be able to log the throughput so I can see the effect it has. I am monitoring the Dataplane CPU but would like to also monitor the traffic.Any help possible would be grand.ThanksJoe Thurwood

Block a particular Google Document

Greetings,One of my users forwarded me a phishing email that points to Google Docs to collect information (username/password). The URL looks like: "https://docs.google.com/a/b/c/viewform?formkey=asdfasdfasdfasdf" (not the real url). Is there a way to block one google doc in PANOS?Thanks,Dave M

QoS Markings

I have a couple pa-500's. I have a voip system that right now sits in front of the FW. I would like to put it behind the FW. If I have my switches and routers currently marking the voip traffic with an ip precedence of 5. Once I move the VOIP systme behind FW will the marking be acknowledge by the PA's? Is it as simple as creating a QoS policy a...

question about packet dump about incomplete, insufficient-data and insufficient-data

Hi...I’d like to a packet dump about incomplete, not-applicable, insufficient-data.I tried to set a packet dump command like below. Set application dump on application incompleteSet application dump on application not-applicable.Set application dump on application insufficient-data.But, I can’t see any packet capture related to these application...

Resolved! SSL VPN user limit

Hello. In technical description for PA-500 (each type has own) is limit 100 SSL VPN Users. This is concurrent (in same time) capacity? Can be defined 100+ users (from AD) but only max 100 will have connection? What’s happen with 101 connections? Thank you. Zdenek

DHCP on PA-2050

I have a PA-2050. When setting up DHCP or modifying an existing configuration is there something I am supposed to do other than Commit the change to make those changes take effect? Like reboot the thing?Austin

Resolved! | display set?

Hi, Everybody,Does anybody know if there is an equivalent of the "| display set" pipe operator from Juniper SRX Junos in the configuration mode in Pan-OS? Thank-you so much for your help answering my question.Dan Sullivan

VLAN's with Palo Alto - Primer/Tutorial?

One of our switches has a couple of untagged connections into our PAN.Each connection is configured on the PAN as a regular L3 interface with an IP address assigned and the interface is in the appropriate zone.I'm interested in reclaiming one of the NICs on the PAN so it would be nice to be able to run a trunk from the switch to the PAN.Where I'...

FIREWALL & PANORAMA

HI.I want to know more about panorama.So my dubt about that.I have panorama registered on my PAN firewall.IF my panorama stop of work , can i manage my firewall directly on my WEBGUI on firewall ?Best Regards Thiago Lima.

Blocking Chat roulette type sites

I would like to block all chat roulette type sites. Omegle, chatroulette, chatrandom etc. Unless I am missing something it is not as simple as it should/could be. They don;t seem to be "applications" and there is not a URL category.Any suggestions? One only has to look at a couple of these "random chat sites" to realize why they should be bl...

Discard candidate?

Hello.I'm new in PANTo discard the candidate configuration changes, is it the same "Revert to running config" and "Load named config snapshot runningconfig.xml"?ThanksLuis

Discussions

Resolved! How HA active/passive 2000 series works

User ID agent / User-IP-Mapping issue