General Topics

Skype only zone configuration...

Hi!I am trying to setup a zone with Skype only configuration with the following "Application Group":skypeskype-probeweb-browsingThe end result is that Skype voice works fine; however, Add Contacts feature in Skype doesn't work.I am testing with the 5.8.0.158 version of Skype under Windows 7.Thx!- john

File Uploads to Wildfire

I have seen another thread on this issue in the KnowledgePoint database; however, there was no resolution or answer to the question. I have setup the Wildfire configuration on all of my PA500's per the documentation provided. When matching the file blocking rule I can see it in the Monitor interface for the file with a "forward" action, but it...

Anybody successfully used 4.1.3 for direct AD group enumeration?

Just logged a support ticket recently regarding the direct group enumeration in PA 4.1.3 on a PA-5K .It seemed that the firewall was only returning the first 1000 AD objects.. which is a default limit defined by the "MaxPageSize" variable in Active Directory.LDAP clients making queries that exceed 1000 results will usually utilise the paging con...

Resolved! show config running xpath syntax

Hello,I try to figure out the correct sytax for the xpath option of the show config running CLI-command (running PAN-OS 3.0.6).? says:+ xpath xpath of the node to retrievebut every way I tried to describe the node I want gives me a "Invalid syntax".

Bittorent session identification

On PA-500 with PAN-OS 4.0.7, I have seen a session on dashboard-top application-last hour, but in corresponding ACC and in Monitor Traffic Log I don't find a record session. There is any reason ? Thanks

After migration from Checkpoint, any tips?

All,We recently migrated from Checkpoint to PANOS (via the conversion tool) and so far things are looking pretty good. The next step of our project is to convert port based rules to app type rules and I wanted to get some feedback, tips, etc from others that have done the same thing..We have about 550 security rules and would love to be able to ...

Service Objects and multiple ports

I have the need to create a rule with three applications, ncp, ms-update and ssl. Two of those applications use their standard ports - ncp (524) and ms-update (80 & 443). The ssl application uses port 13000 - not the standard 443.If I create a single service object using ports 542,80,443,13000 and use this service object in the rule, can a...

UID Agent Not Recognizing Docked Laptops

Last week we depolyed a PA500 for the first time and are seeing an issue with certain computers. The issue is affecting some users who have laptops and are using them on a docking station. When they are docked the computer essentially has two NICs connected (wired and wireless). The issue arrises when the Agent server only recognizes one of t...

Resolved! Cannot import certificates

HelloI know the instruction how to convert the SubCA certificate from an MS CAthe pem files are OKbut I can't import them into the PA, with 4.1.4Te PA starts Uploadding but nothing happensThe WebGUI keep showing the upload process for over 5 minThe same as well with Panorama on 4.1.4I tested as well the pfx format, didn't work eitherI didn't hav...

Increased Data Plane CPU Utilization in 4.1.4?

We recently upgraded our PA-4020s from 4.0.9 to 4.1.4 a few weeks ago. However, since the upgrade, we have noticed a 20-25% increase in our data plane CPU. We usually averaged around 40% during business hours, but lately it has increased to 60-65%. We have not made any major changes to the configuration. Palo Alto support has informed us tha...

CLI command for LDAP status in 4.1.4

Hi,I am trying to setup a server profile for LDAP in PAN OS 4.1.4Unfortunatelly I only see some groups of users but not the individual users themself.Running the command "show users ldap-server" is not available in 4.1.4.Attached is a screenshot of the current configuration. Is that okay so far?What is the way to identify where the problem is?Th...

Resolved! Is there a way to copy partial configs?

If I had a cisco, I could copy/paste partial configs between devices, is there away to do this with the PA?I have some tunnels that need to get built across several firewalls, but I dont want to go to each one.

Resolved! DHCP, AD and VLANS

We've just purchased our Palo Alto and are getting ready to configure. I just had a quick question on using AD.Currently we have HP Procurves connected to a Radius server and Active Directory running DHCP. We'd like to simply and take the Radius server out of the picture and use the Palo Alto to set up our vlans so that they are role based. DHCP...

Resolved! DHCP max number of clients

Hello world,My company is considering deploying a PA box to do some basic routing, NAT'ing, and other functions. One of those is dhcp. We'd like to use the PAN to serve up dhcp addresses for a number of VLAN's. What's the max number of clients that can get addresses from a PANOS box?Thanks,Mark J

FAIL OVER SWITCHs

Hi guys , i want to explain my problem.I have a 2 switches in fail over with link aggregate with 3 vlan`s. (LAN , SAN , Management)I have one PA-500.So How can i configure my PAN interfaces , when 1 switch fail , the 2 switch get all flow and my firewall need to answer my requests. PAN 500 is my Default gateway on my LAN , SAN , ManagementIn thi...