GlobalProtect reports a "Client Certificate Error" but still connects

Hello-I'm running a PA-500 on with GlobalProtect for VPN access. Just recently our users started experiencing an issue wherein they try to connect and receive a "Client Certificate Error" error dialog. However, after they click OK to close the dialog, the agent connects anyway. I investigated the issue myself and found what follows below. No...

The Mysterious "stun" application

Does anyone have a understandable explaination of this application called "stun" from what I can gather its used for things like skype and facetime, but it generates a lot of traffic in my network. While yes we are lync/skype in house and there are the occosional calls out to the internet, I see this application going out to google public IPs on...

GRE Tunnel to Zscalar

Hi All, I have setup the GRE tunnel to Zscalar. I am not able to ping the peer(Zsclar) from the tunnel interface created for GRE Tunnel. I see the GRE tunnel interface is down, cant see any ARP as well from the peer as it is down. Is there anything that i need to get it working? Interface itself is showing down so what should be done for this ...

Can't see the Review Policies or Review Apps link under Applications and Threats

Hello, I cannot see the Review Policies or the Review Apps link on this page? It is simply not there? Ideas? Thoughts? Bug?

Logging and Change Management in Prisma Cloud

Summary: There is currently a size limit of 128kb in compute console history logs. It's likely to hit this limit and then only an error will display in the changes section: "diff size exceeded limit (128KB)". This makes the history log useless for auditing a specific endpoint, as experienced by multiple users. Are there ways to overcome th...

Strange behavior

Hi, facing issue where directed interfaces traffic is not working (from DMZ zone to Servers zone) , while from Inside ZONE to SERVERS is working fine despite inside users SVI is core switch then static route from core switch to paloalto while for users inside DMZ zone their gateway is FW itself (also DHCP ) and no routing is needed to reach SE...

WinRM-HTTP fails with the error 401

Hello, I'd like to request some advice on trying to shift away from WMI to WinRM-HTTP/S based User-ID. I followed the set-up guide by Palo and User-ID server monitoring is able to connect to the domain controller over WinRM-HTTP, but only every hour. If I set session monitoring to something less than 3600 seconds, each attempt by the user-id se...

GLOBAL Protect using SAML Authentication with AWS as the Identity Provider

Hi all, I'm looking for a configuration guide to implement SAML authentication for Global Protect users using AWS ?Basically I want to do the same like this (Azure in this case)...https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PP33CAG Which service do I need on AWS ? Cognito or IAM ? Regards, HA

Get your one-time password from the Customer Support Portal

Reliable metrics to conclude an asset's defended status in Cloud Discovery

The "defended" status, attached to each Cloud Discovery discovered asset, is not reflecting the asset's actual defended status. Across registry, serverless, hosts, etc, Prisma Cloud Discovery uses a loose definition to conclude the defended status of assets. For instance: Registry scans -> Looks at the registry settings, does it have a s...

user-id WinRM-HTTP connection refused

hiafter configuration of agentless user-id using Kerberos with WinRM-HTTP (was hard to get it working needed pa support for it)i encounter this issuei got 2 DC in my environment DCA and DCBWhen DCA is restarted i get Connection refused on both DCA and DCB in server monitoring i get error connection failed, HTTP code 100, Timeout was reached for ...