This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
General Topics
Post a discussion here if you have general questions regarding configuration and troubleshooting for Palo Alto Networks products. Use this forum to collaborate with like-minded security professionals to improve your security posture.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
General Topics
Post a discussion here if you have general questions regarding configuration and troubleshooting for Palo Alto Networks products. Use this forum to collaborate with like-minded security professionals to improve your security posture.
About General Topics
Post a discussion here if you have general questions regarding configuration and troubleshooting for Palo Alto Networks products. Use this forum to collaborate with like-minded security professionals to improve your security posture.

Discussions

Start a conversation

Create custom App-ID signature for specific unknown traffic

Good afternoon.A considerable amount of traffic to/from our Akamai servers is not recognized by our PA-4060s running v3.1.9. We would like to create a custom App-ID signature that would identify all traffic to/from our Akamai servers (based on /28 subnet) as: SU Akamai.Source: akamai-11-053.syr.edu (here we’ll use 128.230.11.48/28)Destinati...

phrounds by • Not applicable
  • 5109 Views
  • 3 replies
  • 0 Likes

Resolved! Websense, WCCP, ETC.

We have an ASA that has a websense connector that allows us to route websense request back to the cisco firewall. I would love to replace with your product. Does the Palo Alto have any functionality like this?

Data pattern strange behavior

Hi,I'm trying to enable some data patterns in order to block banking informations going out from the network.Model PA-500 PANOS 4.0.2The first task is to block Italian IBAN code starting from Checkpoint's DLP blade pattern. This is the regex extracted from a UTM-1 R75IT\d{2}( )?[A-Z]\d{3}( )?\d{4}( )?\d{3}[0-9A-Za-z]( )?([0-9A-Za-z]{4}( )?){2}[0...

zanonibs by • Not applicable
  • 4936 Views
  • 2 replies
  • 0 Likes

Resolved! About DIPP

Hi guys.I checked the specsheet of PA5000 series that showed DIPP, Unique destination IPs per source port and IP, for NAT. but I cannot understand clearly that meaning.What is DIPP means and when do I use that function?Thanks.Regards.Roh.

ttongfly by • L3 Networker
  • 4995 Views
  • 3 replies
  • 0 Likes

Is DHCP Logging for lease-start possible

Hi All,We have got a captive portal set up for guest access which terminates on our Palo Alto firewalls. To meet our code of connection we need to capture DHCP lease offers but by default this does not seem possible.DHCP lease ends are sent to the system log under the event lease-end, but to accurately ascertain when users connected to wireless ...

URL Filtering based on AD Group membership

I'm trying to created a URL filter that only applies to a specific AD Group.I have a URL filter that applies to all known and unknown users, but it's fairly restrictive. I have a group of users that require a slightly less restrictive URL filter.These users are all currently a member of a specific AD group, and I'd like to apply the less restic...

management-console not available via https after upgrade from 3.1.7 to 4.0.1

Hello all,after upgrading from PanOS 3.1.7 to 4.0.1 I can not access the management-console via https.ping and ssh are still working.Even after downgrading back to 3.1.7 and loading the saved configuration, I can not access the management-console via https.disable-https is set to 'no'.Can anybody help?PS:the webserver-logfiles contain the follow...

PBF policy not working.

Hi,I have packets that arrive on interface eth1/10 that I need to be forwarded back out of eth1/10 with a next hop address of another router on that subnet. I have created a pbf rule that I hope would achieve this however it is currently not working. It looks like the following :==========================================================Interface...

debsPal0 by • Not applicable
  • 2768 Views
  • 1 replies
  • 0 Likes

Resolved! Application usage – Implement Time limit

I would like to schedule certain application for user to use. Here are the examples.User can use You-Tube or http-audio only 30 minutes per day.OrUser can only use You-Tube / other streaming media between 9:00-9:30 am and then 5:00pm - 6:00 am .User can visit gmail.com or mail.yahoo.com only 30 minutes per dayOrVisit gmail.com. between 8:00 ...

ssarcar by • Not applicable
  • 4335 Views
  • 3 replies
  • 0 Likes

Comprehensive IANA service port listings

[SO] I'm putting together a configuration and I'm wondering if I'm doing any duplicate work that maybe some other PA customer has already done and may be willing to share. I'm creating service definitions that are IANA defined for example:set service service-mstsc description "microsoft terminal services" protocol tcp port 3389set service servic...

bjaming by • Not applicable
  • 13602 Views
  • 9 replies
  • 0 Likes

Resolved! QoS Question

All,I am trying to wrap my head around QoS and how it functions. What I want to do is to limit the download rate of streaming media. I understand the rule creation and placement. I assign my QoS policy to my trusted zone interface so that the download will be controlled. What I am having a hard time understanding is how this really controls ...

tohoken by • Not applicable
  • 3043 Views
  • 1 replies
  • 0 Likes

Resolved! IPS Signatures

Hi, does anyone know if PAN retires somehow the old IPS signuters?Into the update bulletin there are informations only for new and modified signatures, not for the retired ones.For example yesterday night I received the PAN bulleting and Cisco. In the PAN's email 65 new signatures were added and 14 updated. In che Cisco's 10 added/modified and 2...

zanonibs by • Not applicable
  • 4123 Views
  • 2 replies
  • 0 Likes

500-652 Antivirus Version Makes our PAN unavailable

Guys,Has anybody faced a problem regarding the latest AV version 500-652 as after installation our firewall behaves strangely (Commit failed - Down and up again - AV version mismatch)We have called support and they have told us that there is a process called tdb_compile that needs to be run after installing this AV version and this process consu...

Update PA2020 from 3.0.6

Hello all,I'm doing some maintenance work on a PA2020 and just found out that it is way out-of-date. The software release is 3.0.6 and the other updates Threat and Apps is nonexistent...What is the recommended upgrade procedure for this? I would like to take this to 3.1.8Should I export the configuration and do a factory-reset to release 3.1.8 o...

Resolved! what "session table utilization" is really mean?

Hello guys.I have question about session information of PA. PA showed session table information after command "show session info"And this command contains that information of "session table utilization" but I wonder about that information about maximum session or concurrent session?Thanks.Regards.Roh.

ttongfly by • L3 Networker
  • 3667 Views
  • 2 replies
  • 0 Likes
  • 24404 Posts
  • 123 Subscriptions
Labels
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks