Is there a requirement for PANOS version to match for SD-WAN or for the Hub site to be of a higher version of PANOS. Example: Hub is on version 10.2.4, Branch is on 10.2.6 Would there be any issue with this?
We have Palo Alto firewall with three Internet links. One is a leased line and other two are ADSL links. I have configured ECMP on the two ADSL lines to load balance traffic on the two ADSL links. Global Protect is configured on the leased line. I have configured default route to all the three internet links in the firewall. I have configured th...
We are receiving suspicious alert from Palo Alto firewall on syslog server. how to stop receive these alerts. <46>Oct 24 05:50:14 PA-3020 -- MARK --<46>Oct 24 06:10:14 PA-3020 -- MARK --<46>Oct 24 06:50:14 PA-3020 -- MARK –
Hello everyone, I am trying to make a self-signed cert for use with Global-Protect in my lab. I go into Device, Certificates, Generate, give the cert a name, Root_GP_Cert, common name of 192.168.189.155 which is the WAN side IP Address. Click the Certificate Authority box and click ok. Then I click on Generate again, this time I use a differen...
Hi There, Currently, I'm testing redundancy for vWire pair. I have replicated the existing vWire and sub-interface configuration to another couple of interfaces. Now both the vWire pairs have identical configurations including the zone. I anticipated the stateful session to fail when the traffic switched from one vWire pair to another. But whe...
These are some suggestions that would help a lot when creating new rules: 1. Highlight modified uncommited policies. You may argue that a user should know what the is chaning, but the problem is multiuser. When a user has a candidate rule, but hasn't applied it, other users cannot tell which rules have been modified. 2. Allow testing of ...
Just wonder if there's a way to set up ADCS to work along with OCSP.
Hi guys. Does anyone know how to set a rule to be notified when new users join the network?
Good dayI am sure this question is answered somewhere but I somehow cannot locate it, so please be patient as I go through the problem we experience.Our company's US URL is listed as High-Risk when testing it through the URL Filtering website even though we provide a legitimate service and product across the world. I did change the category in h...
Apologies if this is a basic question but first time I do this maybe in a real production environment and I have no prior experience. Does anyone have an example of restoring Palo Alto in AWS (from a snapshot)? Where could things go wrong in the restore process for example interface issues. If anyone has experience please let me know.
Hi Team, Users are trying to access ChatGPT and getting error, but we have allowed teh ChatGPT APP-ID and still the same. Not even seeing any error at all. What is the best way to fix it? Regards, Sanjay S
Hallo Everyone, I am using PA-220 let’s call PaloAlto-Firewall “X” Office Firewall “Y” Other firewall “Z” Firewall X has 8 Interfaces. Interface 1/1: has the IP-Addressee 192.168.5.254. we assigned this Interface to a Zone Called "DMZ". When this firewall and this Interfaces want to communicate with our office Network it send the traffic to fire...
Hi all I noticed that email notifications in ver 11.0.1 are kind of broken from the formatting point if view they just look like a blob of text, instead of a decent formatted email in ver 10.2.4 is there a way to fix it? Thank you
Hi, I am testing global protect using Prisma Access - Panorama managed.. On panoroma - i have a mobile user security rule applied with a custom URL filtering profile enabled where I have set the action to block for some of the newer URL categories introduced by PAN in recent times.. ie 'ransomware', 'scanning-activity' and 'command and control'....
so our organization recently upgraded our firewalls from PANOS 9.1 to 10.1. ever since the upgrade, we've had an issue with HA pairs not synchronizing their configs automatically. this does not seem to happen every time a commit is pushed from PAN but it happens regularly enough that we have to manually sync at least one pair weekly. is this som...
PavelK
on:
Throttling ingress bandwidth on a sub-interface
