General Topics

Palo always resolves rDNS - any way to override?

Let's say you have a single physical host with multiple IP addresses with each IP running one or more websites/services.DNS best practice is apparently to have PTRs pointing to the physical host name, so you might have:PTR hostname.domain.com 1.1.1.1PTR hostname.domain.com 1.1.1.2PTR hostname.domain.com 1.1.1.3when your forward DNS is:A hostname...

Documentation for set up PPPoE in PAN OS 3.1.x

Hi ,Did anyone have an completed documentation or guide on how to set up PPPoE connection in PAN OS 3.1.x?

20mb of free memory left

Is it ok to have only 20mb of free memory left out of 1gb on your 2050 device ?

Resolved! Custom reports

Hi, I am wondering if there is a document listing the most useful custom reports to setup.Thanks

unable to pass active directory loing in trasnparent mode

hi,recently i implemented pa-2050 in a network where they have MS-ISA acting as a proxy, the moment i installed the PA i transparent mode front of the proxy it can pass network traffic ( ping telnet etc... ) but the browsing traffic which include integrated authentication it doesnt work, if we remove the authentication from the Proxy , everythin...

Updates - problem

Hello,I have problem with my PA-500 os 3.0.2When I try to get updates for example software I get Failed to get upgrade info. Please try later.Policy is just fine, BUT I don't see any traffic going into updates.paloaltonetworks.com.I setup filter and perform debug but couldn't see any traffic dst for updates.paloaltonetworks.com.My service router...

Zero-day Vulnerability in Internet Explorer

Microsoft released a security advisory today regarding a zero-day vulnerability in all supported versions of Internet Explorer that can be exploited remotely.We are working on creating signature to protect against corresponding attack. Please stay tuned.Thanks,Sandeep

Resolved! Colour Coding Rules?

I can put in a feature request but I figure it's also worth asking here as maybe this is just something I'd find useful, maybe it isn't..Are there any plans to allow colour coding of policies?Even on our small scale PA-500 I find it quite difficult to quickly distinguish between inbound and outbound policies if I'm looking at the full list - bei...

Resolved! Swamped with Syslog logging...

Our PAN is in an L3 config, and our syslog server is in a virtual-wire zone.Basically, if I look at monitor/traffic or monitor/session browser, I'm simply swamped with syslog messages as everything is being syslogged once as the PAN management NIC goes from trust (LAN) to untrust, then again as it goes through the vwire-untrust to the vwire-dmz....

Speed Test through Palo Alto pair

Hello group,We are in the process to set up and replace the current firewall with PA-4020 pairs . During pre-test, one thing came up. Using several Speed Test sites, the results are not what we expected, particularly the UPLOAD speeds are far off .It is a big HELP if the group let us know what are your Speed Test results comparing to the expecte...

Resolved! Commit - Error

Hi,I am getting this error.Operation : CommitStatus : FAILIEDDetails : A commit is pending. Please try later.The issue has happened once before and the only way I could fix it was a reboot, i really do not want to do that, I have waited over an hour but the issue still remains.Is there a CLI command avaible to reset this issue?ThanksDarren

Proxy block

Hi,we have some clever students...they have found if they get a proxy address (prior to joining our network) and add it into their firefox they are getting out on the internet and from what they say bypassing the Palo URL check.Is there a way I can lock this down, I did think of http-proxy would this do it or is there a more robust clever way?Th...

Exporting translations for an IPAM system

I've been working on automated scripts to export my firewall configurations, gather the NAT translations and reformat the exported data into the XML format used by my IPAM system.I've managed to automate this on our Check Points by parsing the objects.C file directly from our firewall managers - however, chopping through the PA config isn't quit...

Resolved! Schedules

Hi,with schedules, do they apply to the policy or just URL filters?I am trying to block certain apps at certain times, I just want to confrm in my mind that schedules are applied to the whole policy, effectively switching it on or off at times?Also we have wireless users and I want to switch off their connectivity at say 2130hrs.Would the policy...

Resolved! PA-2020 OSPF Capacity

Hi,I've seached the data sheets and discussion forums but could not find any information on the size of the forwarding table for a PA-2020.We wish to run OSPF on this box and I need to understand the limitations related to the size of the OSPF database and number of link states we can store.Any pointers?Cheers

Discussions

Palo always resolves rDNS - any way to override?

Documentation for set up PPPoE in PAN OS 3.1.x