General Topics

Device certificate advisory when firewall doesn't use the mgmt interface for these connections

Hello. so in regards to the palo advisory of upgrading and rolling out device certificates we are running into an issue which I'm not sure what the impact is. we have a number of panorama managed firewall clusters. however these firewalls don't use their mgmt/oob interface for connections to palo alto services or dns. as a result after following...

input logs firawall

Hi, is it possible to add information imported from another event log to the logs of a Palo Alto firewall?

HA upgrade oddness (no preempt)

Hello, just seeing if anyone has an explanation or has experienced this before. I followed the HA firewall upgrade guide and experienced this unexpected behavior. i suspended the primary, ( secondary went active), installed the new os, and rebooted. Upon reboot, it was no longer suspended, came up and went active and caused a split brain. After ...

Possible NAT issue on a PA-3260

Folks, I am trying to configure a NAT policy which should be bi-directional. Here the traffic can be initiated from outside or the inside. The policy is configured and I can see NAT hits. However, this policy does not work. The NAT IP is from a subnet which does not reside on the Untrust interface. This is where I see the possible challenge is...

Resolved! Panorama Software Upgrade

Hi All, Just wanted to confirm I have the process right. We're running Panorama, M-100 appliance (32GB RAM), managing 3 pairs (6 no) of PA-3220 firewalls. All currently running PAN-OS 8.1.5. Looking to upgrade to the next major stable release, currently listed as 9.0.6. From what I have read, upgrade path is, Panorama first, 8.1.5 > 9.0.0 &gt...

Captive portal authentication over TLS

Hi, I've enabled captive portal on our systems, following the PA docs (Configure Authentication Portal (paloaltonetworks.com)). I have an SSL/TLS profile created with a valid, trusted certificate signed by our own internal CA. When our machines try to authenticate to the captive portal, they do so over HTTP not HTTPS. Is there some way to force ...

Resolved! How can I get a domain removed from the DNS Sinkhole parked domains list?

Hello! I have purchased a domain that was previously parked. Unfortunately, DNS queries for this domain are getting intercepted by DNS Sinkhole. Is there a process for getting a domain removed from the parked domains list? Thanks.

Prisma Cloud: Azure Active Directory resources not being ingested

I have provided Prisma Cloud with all the necessary API Permissions and more, along with granting the necessary roles needed to view Azure Active Directory Security Settings. The issue lies in resources showing up in Prisma Cloud itself when queried, e.g Identity Protection related resources or Active Directory Roles and Administrators or even P...

Add disk collector panorama (missing)

Hi, We are trying to add a new disk in collector (panorama). We follow the correct procedure and we can see the disk running: show system disk details. This is the disk: Name : sdhState : PresentSize : 2097152 MBStatus : AvailableReason : Admin enabled But if we go to "managed collector" the new disk is missing (Disk H): Whats happ...

User-ID - Windows Server 2022 , not working

We are running a Windows server 2022 and PA-3220. I have the user-agent put on a seperate Win 2022 server. The firewall when communicating with server is getting dropped code 5986. Under my Server Monitoring it shows Connection refused(0).

Resolved! CVE-2024-0010

Hi there everyone. Could please someone clarify for me what versions are affected regarding CVE-2024-0010 as seen here? https://security.paloaltonetworks.com/CVE-2024-0010 My inquiry goes for version 10.1.11-h5. Is it affected or not? Because I believe there is an error in the way this is written in the article. If 10.1.11-h5 is affected, then ...

Resolved! SSL/TLS Vulnerabilities

Dear Team , We have a customer, who found SSL/TLS Vulnerabilities on audit SSL/TLS configuration The firewall supports weak cipher mode CBC. kindly provide the solution to remediate the weakness. snip attached for Refr.

lsvpn problems with connecting to gateway

We have a lsvpn architecture and we are having problems with one of the satellites connecting with lsvpn gateway. We configured and maintaining this lsvpn for the past 1 year and dealt with most of the problems. Usual one being credential cookie expiration and we had to manually go in and put in the credentials. Other one is sometimes we have to...

device telemetry Failed to reload config files

Since the update from our firewalls to 10.1.10h2, i see in the system logs the event : Type: device telemetry Event: config-reload-failure Description: Failed to reload config files. The sent of the telemetry files is working. This happens every time after a commit from panorama to the firewalls. The firewalls are HA setup managed by panorama. I...

traffic log database exceeds alarm threshold value 100% of total allowed size

Hello community, On my paloalto 850 I get several alarms every day stating: "Current suz (xxxMB) of traffic log database exceeds alarm threshold value (100%) of total allowed size (xxxMB). On the CLI a "show system disk-space" shows the disk on not full: Filesystem Size Used Avail Use% Mounted on/dev/root 9.5G 3.4G 5.6G 38% ...

Discussions

Device certificate advisory when firewall doesn't use the mgmt interface for these connections

input logs firawall

HA upgrade oddness (no preempt)