General Topics

Panorama Minimum Requirements for AWS Deployment

Hi all, I am new to Panorama management, and I am specing out a new deployment for a client. 1 - VM PA in AWS 1 - PA 440 for Office We want to manage the VM and 440 PA with Panorama. Looking at the AWS deployment documentation https://docs.paloaltonetworks.com/panorama/9-1/panorama-admin/set-up-panorama/set-up-the-panorama-virtual-applian...

Policy-Based IPsec VPN Failover

Hello everyone, I have a case, where we have configured two site-to-site VPN connections to our partner's primary and backup datacenters. Both tunnels are policy-based IPsec VPNs with Proxy-IDs configured and both use the same local/remote inner IP addresses. This is a single ISP/single virtual router environment. For example this is a sample ...

Resolved! 'HA Group 1: Running configuration not synchronized after failure'

Hi All, I guess it is expected for the device to throw the error message below: Thanks,Myky

Use of HA2 and HA3 port Active-Active-Active

Hello,We have changed PA-5220(10.1.6-h6) by the PA-3420(10.2.5) , and we have detected that much more traffic is being sent by the HA2 and HA3 ports. Being unbalanced, it saturates a port of HA2 and may cause an error in the synchronization of sessions. Does anyone know how to check this or know the reason why this is happening? Thanks

Resolved! add a name to an address object in an address group xml api paloalto

I'm trying to add an address object to an address group, but it won't let me add it. I get this error: <response status="error" code="12"><msg><line><![CDATA[ "nameAddressGroup" -> static 'nameAddressObject' is not a valid reference]]></line><line><![CDATA[ "nameAddressGroup" -> static is invalid]]&...

MS RDP

Need Assistance setting up RDP access to a few devices. I would like to be able to RDP (MS) from outside to a specific IP inside. I would like to NAT the port. So I would like to, for example, RDP in from outside using our public IP using a custom port connecting internally to a private IP with the default RDP port (3389).

Data filtering profile is not showing in the profiles list

Dear Freinds, I have the below licenses on my firewall,Adv URL filteringAdv threat preventionDLPWildfireDNS securitybut Data filtering profile is not showing in the profiles list?

Resolved! Active Sessions count

Hi Team, Can we get a graph for active sessions for a weeks time? Or is there any way i can get the history of the active sessions? Regards, Sanjay S

Issue with Connection being Categorised as a Threat

For the past 5 or 6 days I've suddenly started getting a connection to a Palo GUI categorised as a threat, this worked previously without issue. When I've looked at the traffic logs it shows source and destination as correct but under the PCAP it says that the URL - 90.4.19.156 is blocked as medium risk\unknown, see below. I'm a bit flumoxed as ...

Virtual Adapter problem due to WMI error from windows 10 Update

GP client having issue with virtual adapter due to a windows upgrade can be fixed by running the following commands as an administrator via the cmd prompt. cd c:\windows\system32\wbemregsvr32 /s %systemroot%\system32\scecli.dllregsvr32 /s %systemroot%\system32\userenv.dllregsvr32 cimwin32.dllmofcomp cimwin32.mofmofcomp cimwin32.mflmofcomp rso...

Resolved! Link Group and Subinterfaces

Dear all,I'm trying to set up our link monitor configuration in our 440, and I ran into an issue. Each of our physical interfaces has many subinterfaces, so the question is:If I set up a Link monitor for a physical Interface with many subinterfaces, and only one of those subinterfaces fails, does it trigger a failover? Or do all of them have to ...

Configuring Incoming SSL Inspection for email

So, We have an on-premise Exchange server that is inside our firewall, so incoming and outgoing external email goes throught the firewall. We are having issues with file blocking on emails. We do have SSL inspection set on the traffic from outside to inside for email, but right now it is set to Forward Proxy and we receive no errors, the email i...

How do I block BBC iPlayer

I'm trying to block BBC iPlayer on our firewall, but still unable to block it. I need help to block it as soon as possible. I've checked online but no luck, please help.

Resolved! GP Client Download

Hi Team, Is there any way that we can download the GP Client? Apart from connecting to the GP Portal and downloading it? We need to test the new version by using it for few days on few machines before we get it into prod. So what is the best way, any suggestions please. In Cisco Anyconnect we have option in the Anyconnect Profile setting to st...

Resolved! Security Profiles

Hi All, I am bit new to this; may I know if the Security Profiles added in the ACLs works only if we create Decryption rule for that traffic? First it will decrypt the packet then start checking for the AV, URL, File Blocking, VP, Anti-Spyware and WF? Is my understanding, right? If we do not have Decryption rule in place the above profiles added...