General Topics

Allow certain EXE downloads by filename

I use data filtering and currently block EXE downloads amoung others. My problem is now my users can't download updates to their malware software. The malware software we use currently doesn't offer a centralized management feature so the updates have to be downloaded from the web. The updates come from a content delivery network so the only way...

No space left on device

I'm trying to upgrade software 4.0.1 -> 4.0.2. When I am downloading new image via web I receive following error :Traceback (most recent call last): File "/usr/local/bin/swm", line 10, in ? swmmain.main(sys.argv[1:]) File "/usr/share/pan-swm/swmmain.py", line 91, in main UI.runCommand(H) File "/usr/share/pan-swm/swmcli.py", line...

synchronization in progress issue

Hello,We're new PA users - we've brought up a pair of 5050s running 4.0.3 with the HA patch for virtual systems and we're getting a "synchronization in progress" message for prolonged periods. It then eventually reverts to not synchronized. We can't find anything in the logs and doing a config diff has us a little stumped - it shows a diff in ...

Resolved! Panorama 4.0.3 - System Logs not showing source device

I have a Panorama server running PANOS 4.0.3 with 2 PA-4020s connected to it running PANOS 3.1.8. I noticed since upgrading the panorama to 4.0.3 that the system logs no longer show the device name or IP that sent the system log to the panorama. This is a challenge because I can not identify which system log is coming from which managed device i...

Disable SIP ALG

Hi,Is there any way of disabling the PAN SIP (Session Initiation Protocol) application ? My Voip provider has asked to turn SIP ALG off as they think its interfereing with the headers.https://live.paloaltonetworks.com/docs/DOC-1216 This article says the PAN SIP app acts as a Application Layer Gateway.Regards,Sunil

Resolved! manage standalone or in panorama

I heard its best to manage the firewalls in Panorama. I have imported the primary and secondary firewalls into Panorama.....i had 1 security rule that i added directly into the firewall (not via Panorama) - any ideas why i cant see this rule from Panorama? just trying to understand this before i start adding rules and updating the firewallstha...

Configuring URL filtering from command line

Hi all,Just wondered if anybody knew of a quick way to apply the same action to all categories within an URL filter please?It's not the end of the world if it can't be done, it just seems to me that a wildcard option would be useful.For example, if I wanted to create a URL filtering profile called "minimal" which just allows 3 categories, I woul...

Resolved! bright cloud updates 3.16

Recently i have requested to make changes in one URL from brightcloud because of the wrong catergories and they said they have made changes in 3.61 version.i have downloaded the lastest updates 361 for URL in paloalto , still when i open the site it is coming in the wrong catergoies .

Resolved! query on cpu usage limit

Hi,Can anyone clarify me on below queryIn CLI if we type show resource monitoring, it will show us the status for cpu ...what parameters should consider in resource monitoring(for IDS Health check)and what is the max limit for cpu usage and buffer size capacity.ThanksPriya

Is it risky to that allow browser-based apps on any ports

I'm considering to create a policy for Internet access to replace traditional Internet rule (i.e. outbound 80/tcp or any other ports raised by user per special request). To minimize future special request by user, I prefer to allow any ports if app-id identified the traffic as "browser-based apps". Would it be too risky to enable such rule (pr...

PANOS 4.0.1 - Email Alerts are no longer easy to read

Since upgrading to 4.0.1 the email alerts are all in one line, no longer very easy to read.Can we fix the formatting of the alerts please

Can I not to install user identification agent to the domain controller?

The client would like to use their Active-Directory for user identification in PAN.However, they are not prefer to install the agent in their domain controller.Is it possible to install the agent in a computer which has already joined the domain, but not on the domain controller?If so, what rights the user account/computer should have?Please als...

Outbound email traffic is using the public IP assigned to FW external interface

Hi,New user of PA Firewall here. I noticed that when we send out emails, the recipient is seeing that the email comes from the public IP which is assigned to the external interface of our PA firewall. Before moving to PA, we can see the public IP NATed to our email server. Is there any configuration we missed? Or is this how it should be?Appreci...

Resolved! APP limitation using PBF

Hi,after doing an upgrade from 4.0.1 to 4.0.3 the candidate config fails due to incompatible app used at PBF. Where can I find the compatible app with PBF? There's no way to use custom app with pbf?Thanks,Robclav

Resolved! About APPs with PBF

Hello Team.I seached and know that PBF can be used with Application that not to have HTTP tunnel function and application dependency. so I want to know what application is can be used with PBF rule. If you have a list of application for PBF, let me know. Thanks.Regards.Roh.