These two snapshots are from two different VMs, which have installed GlobalProtect VPN. However, I saw different log messages printed out (check the marked part). I am just wondering why bindEntry is different on them? Thanks
We ran into a situation where the OSPF was stuck into EX-START after upgrading the PAN_OS software from 9.1.10 to 9.1.16 (Preferred release). We have a deny-all rule above the Intrazone-default allow, but it was working fine previously. We checked that MTU was not an issue. We understand from this article - OSPF Neighborship Stuck in Extstart St...
Hello All, Recently, we started seeing threat events from different Palo Alto IPs (example subnet 198.235.x.x). When we check them in AbuseIPDB, they show up as 100% malicious: https://www.abuseipdb.com/check/198.235.24.146 Microsoft TI also categorizes them as malicious, but not the PA FWs. Does anyone know what these subnets are used for or ...
HI, Continuously receiving vulnerability threat events (Non-RFC Compliant DNS Traffic on Port 53/5353(56538)) form the same source IP towards our PA public IP addresses. The source is also clean and belongs to Vodafone ISP. I could not find any other trace to resolve the issue. Please assist how I can proceed to resolve it. What action I ...
LIVEcommunity is pleased to announce the 2023-24 Cyber Elite Program! Cyber Elite members are LIVEcommunity super-users and cybersecurity experts who are generous in sharing their insights and expertise to help others in LIVEcommunity. Want to know how to tell who is a Cyber Elite expert? Look for the Cyber Elite trophy icon next to a user...
Hi, I searched and read a lot about it, but the more I read the more I get confused. I would appreciate, if someone explain me the difference between self-signed and public trusted certificates for SSL Decryption. As I understand, I need to import it into endpoints machines anyway to make decryption work. Then what is the point of public trust...
Hi Team, Need guidance on how to generate report using dump file. I cannot find the link. can anyone assist? Appreciate it
Hi The issue on panorama is there for long time. Anyone can help to resolve it? When panorama vm is created on eve-ng on ESXi, its speed is very slow and even stop or stuck there. I found the slowness is related with memory and storage size available. because i can see the panorama vm storage utilization become more and more until the storage is...
I have seen unusual traffic in the Firewall. A lot of sessions are generated from an interface (inside) to the IP Address 5.5.5.5 to the outside interface. I would like to know what process or the reason to the Firewall generated this traffic. I check the NAT Route and I don't have to configure something like that. I am a little bit worr...
We are running into issues with VPN when we chose not to use PROXY ids between two PA firewalls. We see it works fine when we add the proxy ids, but we shouldn't need to if both of them are Palo Alto, isn't it? We see phase 2 keeps failing and the tunnel would not come up. "IKE phase-2 negotiation failed when processing proxy ID. Cannot find mat...
Hi all , Can we install Cortex XDR agent on VMware ESXi Host Machine? If yes please share the respective supporting documents.
Hi everyone. Currently I have a request. When vpn user is accessing throught globalprotect is necessary that fullfill two thing: If device is corporate (domain) he can use internet resource enterprise internet. But, when device is personal he must navigate with their own personal internet resources. Can I reach this with HIP profile and split...
What is the CLI command for viewing transceiver light levels? Palo Alto 7050
I have a VPN tunnel, which is up and running. I have two proxyIDs in the tunnel with the same local address but different remote addresses. I can only get one proxy to connect. For example, I currently have proxyID1 connected and can ping the other side. In the CLI, if I type test VPN ipsec-sa tunnel tunnel-name-proxyID2. It does not come up. I ...
Good morning, reviewing the documentation of palo alto and fortinet informs me that they use the same internal ports for the fsso and for the user-id and to rule it out completely I wanted to know if you could configure the fsso and the user-id in the same server and that they are working simultaneously.
