General Topics

AD/LDAP Server authentication

Does anyone have any tips for getting AD/LDAP bind request working at the server. I have the PaloAlto sending and receiving the bind request to authenticate, but the server reply packet says the credentials are invalid (error code 52e - invalid credential). My AD server administrator says the requests aren't making it to the server, but I have...

Simple Policy Question

This is a simple one, but I couldn't find it specifically stated in the manual.When I define a security policy, are the Zone and Address exclusive of each other? In other words, if I select a zone,it requires I put in specific IP's or select Any. If I leave the IP's as any, but select a specific zone, will it only allow IP's from within that z...

Resolved! URL Category priority

HiI am wondering what will happen if one URL is in two different categories. Especially if one is configured to block, the other to pass the request.I don't know if this can happen within predefined categories (from BrightCloud), but as i am able to define new ones, its possible to add a already categorized URL in my own category.Our goal is, to...

Resolved! Trusted Certificate with HA

Hi All,Hi have a PA-2050 with a HA, we need the SSL VPN with trusted certificate. How can I generate the CSR key in the PA?Thanks.

Resolved! Range header DoS vulnerability Apache HTTPD 1.3/2.x \(CVE-2011-3192\

CVE-2011-3192 Was published yesterday. Are there any mitigation steps I can make in the PaloAlto until they release a vulnerability update?http://mail-archives.apache.org/mod_mbox/httpd-announce/201108.mbox/browser

Resolved! how can we delete reports on the panos4

Hihow can we delete/remove old custom reports or pdf summary reports on the panos 4 with cli?regards

Resolved! Trunk / Link Agg Recommendation

I have a 5060 I'd like to carve up and use one of the vsys's on it for a back-end firewall. My plan was to take two of the 10Gb ports and LAG them together, sending all 4 of my vlans in and out on that one trunk. Will that work, or is there a better way to architect this setup?I'm a little lost in setting this up and creating the vlans to resi...

Problems with PAN

We are a PAN partner and have some issues with the boxes . We have a PA 500 installed for testing as we are looking to do some live demo for clients . I have a laptop connected to the lab running logme in, skype . The unit has been on live traffic for about 4 hrs and it can't detect neither the Skype nor the logme in . incomplete or insufficient...

Resolved! Session Browser?

Just looked at Monitor->Session Browser. This is cool! Why is it not documented anywhere? Is it new and I just missed something?

Panorama SSL Decryption Rules

Hi all,I have some problem during commiting decryption policy (Forward Proxy) to devices from Panorama. Panorama tells me only one things: "commit all failed" :smileymischief:I suppose something related to decryption certificates that are device dependent. For this reason I tried to import the certificate generated from the PAN device inside the...

SSL decryption in 4.0

Hi,Is there an article describing how SSL decryption is to be configured in the current version 4.0 ? I can see there has been some changes in the way certificates are being used.Regards,Sunil

Respond to ARP for path-monitor IP in virt-wire mode?

Does anyone know if PANOS 4.0 responds to ARP requests for the IP used in HA path-monitoring?I know that path-monitor sends pings or something similar to the devices it is monitoring. When you setup path-monitoring, you specific what source IP should be used for the pings. I also know that in virtual-wire, the monitored devices have to be on t...

Resolved! Virtual System Settings - Recources

When setting up virtual systems, what are the general guidelines for settings in the resources tab. Do they have to be filled in with a number? If left blank, how does the system divide resources?

Resolved! URL Category Action = None?

Hmm, Page 148 of the 4.0 Admin Guide lists all the category actions except 'none'.What is 'none'? It doesn't seem to do anything. If i select it and click OK, the action has gone back to 'allow' when I reopen the URL profile.I have two main pools of users: employees and students.I'd like to make custom URL categories for employee-block, employee...

Captive Portal with Session Cookie - Synchronization problem

Hi, I have a pair of PA 2050 in cluster and the synchronization was working fine until I try to enable the option Session Cookie in the Captive Portal configuration. The only way I have find to re-synchronize my cluster is to disable the Session Cookie option, restart management server, synchronize secondary on the primary and vice versa. ...

Discussions

AD/LDAP Server authentication