This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
General Topics
Post a discussion here if you have general questions regarding configuration and troubleshooting for Palo Alto Networks products. Use this forum to collaborate with like-minded security professionals to improve your security posture.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
General Topics
Post a discussion here if you have general questions regarding configuration and troubleshooting for Palo Alto Networks products. Use this forum to collaborate with like-minded security professionals to improve your security posture.
About General Topics
Post a discussion here if you have general questions regarding configuration and troubleshooting for Palo Alto Networks products. Use this forum to collaborate with like-minded security professionals to improve your security posture.

Discussions

Start a conversation

GRPC status UNAVAILABLE in intelligent offload

Hi All, Has anyone else come across an issue where a process called 'pan_grpcd' is using upwards of 85% of the CPU on a PA-VM. The VM is running version 11.0.2 and i can see an error in the system logs - 'GRPC status UNAVAILABLE in intelligent offload' I have logged this with TAC however they seem to be at a dead end currently.

ElliotM by • L2 Linker
  • 2873 Views
  • 4 replies
  • 0 Likes

Need to create firewall policy that allows only Microsoft teams and rest all need to block

Hi Friends, I would like to create Palo Alto configuration for specific range of IP address, not based on users.My requirement is as follow.1. Only Microsoft teams traffic (incoming and outgoing includes calls) should be allowed.2. Want to block all other traffic includes web browsing, file sharing, social media, media streaming. Anyone can sugg...

Asynchronous Security Zones?

Is there an issue with asynchronous routing if the traffic passes through different security zones? We have our PAs setup with subinterfaces for our respective VLANs. So we have:Eth1/3.10 Eth1/3.20 Eth1/3.30 Eth1/3.40 These subinterfaces connect to a trunk port on an Aruba 6300. The 6300 just has a default route configured which points to to t...

Resolved! How do we config a basic setup for guest wifi app blocking

We are relatively new to Palo Alto detailed configs, although we have used url filtering, av filtering, etc for some time. We want to start doing a better job blocking at the application level on our guest wifi, especially in the areas of peer-to-peer, etc. Are there some basic guidelines or configuration guides on how to get started. Baselin...

high latency after HA failover

Hello team, I have an HA active/passive with a couple of PA-3250. After failover from active to passive there are a high latency for all the connections and some Http/https sessions cannot be established. I see in the traffic logs many aged out sessions and tcp-rst-from-server and also tcp-rst-from-client. After one minute aprox. the system gets...

Carracido by • L4 Transporter
  • 3923 Views
  • 4 replies
  • 0 Likes

No Logs for matched rule

Hello everyone, We are facing a strange problem with one of our PA-220. I created a rule to allow all traffic between 2 different zones with our default log settings. The problem is that I only see a hand full hits and nothing in the traffic log. Yes there is traffic because I see it when I start the paket capture. There is traffic in booth di...

Website Access Issue from one of branch office

Hello All, We have PA-850 implemented across the sites (4 sites), there is a URL www.crunchydata.com is not accessible from one of Branch Office in US, while there is no issue accessing same URL from other branches. However - i have checked and confirmed via detail packet inspection where i am getting hello client and server response back to cli...

ECMP Single Interface

I have an HA pair of firewalls in my data center. I have a single ISP that provides two routers for internet access. I use HSRP on those routers, which obviously share the same subnet on the inside interface that connects to the outside interface of the Palo Alto firewalls. I have two instances of HSRP setup to where some of my other perimeter d...

create a new Vsys queries.

Wish to configure new VSYS, will it cause any issue while configuring? Do we need to reboot after enabling Multi-vsys opention? Will it will cause network disruption over default VSYS1? · Will it will affect the functionality of Access Control Policy on the default VSYS1? · Will it will affect the entire functionality of default VSYS1? · Could...

Global Protect have issue after firewall upgrade to 10.2.6

Hi, Yesterday we upgrade Pan-OS version from 9.1.13 to 10.2.6. GP version on 5.2.12. Now we have issue with GP as we have difficulties to connect the Gateway with error Cookie expired/Authentication failed We can confirm the Radius server is reachable we can ping it from the firewall. There were no changes made on the firewall except upgrad...

IPSEC VPN tunnel

We have a site to site VPN tunnel that fails when the vendor side tries to Re-Key. We are seeing no U-Turn policy blocking them. We can ReKey from outside without issue. 1. Has anyone seen this issue previously and been able to fix it? 2. Does anyone have a script that can be run that will logon our firewall and allow me to run 2 commands to ...

  • 24412 Posts
  • 125 Subscriptions
Top Solution Authors
View All
Labels
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks