General Topics

SSL decryption - How to deal with third party sites that don't install the intermediate certificate?

I turned on TLS (let's start calling it what it is) decryption for our IT personnel only a couple of years ago. It was considered a pilot and I always planned to work with our legal department to craft a policy and start rolling it out to the broader organization; however, it seems like every time I get ready to do that, one of our IT users rep...

Next Hop in default route using DHCP Comcast modem

Hello Group, I am setting up a PA-200 in my SOHO with comcast as my ISP. I have comcast for my isp and am using DHCP to optain my IP address. My question is this. Per the setup guide, if I check DHCP under the IPV4 tab, and check, Automatically create default route pointing to default gateway provided by server. Am I to assume this will creat...

Factory Reset

I was in the middle of setting up a PA 850 and in the end needed to conduct a factory reset. I issued the commands to put into maint mode and was able to log in with maint@ip and the serial number as the password through putty. I had to step away for something else and came back and my session ended. Tried logging in through ssh and GUI but I am...

Resolved! Minimum Code for PA-415/445

Hello, looking at the PA-415 for a small office and I can't seem to find the minimum code required. The datasheet shows performance results using OS 11.0 but there's nothing to indicate if you can use 10.2 code. TIA!

DHCP client support for IPv6

Hi, You can't configure an Ethernet Interface as a DHCP Client for IPv6 like the IPv4.Does anyone know this will be supported in the (near) future?I can't find anything about this.

SMB traffic identified as active-directory

From one of our management servers (Windows Server 2016) SMB traffic is identified as active-directory, but from user clients it's correctly identified as ms-ds-smbv2. Anyone come across this? We have several storage solutions (NetApp filer, iSCSI, DFS on Fibre Channel storage), and it seems to happen with all of them. One more thing: this only...

Firewallupdates via Panorama - huge delay in download and install

Hello, I'm managing several PA firewalls (10.2.2, 10.2.3, 10.2.4-h2) via Panorama (10.2.4-h2), I noticed a delay in AV, Content and App update deployment, sometimes it's days or even weeks. For example, the App update is planned to check and install every 30 mins. Release time is 3:30 in the morning, now it's 6:40 am here and the downlo...

Firewall processes sometimes are in suspended state

Dear community, I have observed that processes "log_index" and "stats_gen" appear in "suspended" state sometimes. We didn´t notice any issue though. Do you know if that´s a normal behavior? Kind Regards!

Resolved! ECMP Virtual Router Inquiry

Good day, I have an inquiry regarding virtual router. We are transferring our ISP from vsys2 to vsys1. So, we encountered a message while in the ECMP configuration that requires for the Virtual Router to be restarted. So, here's my questions, what services might be affected once we restart the VR and for how long does the restart will take? A...

Problms with VPN Global Protect

Good morning, I currently use a reduced version of Global Protect VPN, every time I start the program it asks me to update, but for company reasons I shouldn't. The version I'm using doesn't have as many menus and there's no part to remove the update checkbox. Could someone tell me if it's possible with some registry configuration or something s...

Resolved! verify data traffic

I suspect my pair of pa3020s stopped passing data for a couple of minutes. How do i check? They're running panos 9.1.13-h3

MOST COMMON ERROR MESSAGES

In your experience, what are the most common mistakes you have had when implementing Cortex XDR in a company?, enable ports, basic configuration, etc. Cortex XDR

Resolved! Understanding Static NAT

Hi All, When it comes to Static NAT it will be one to one NAT in vendors like Checkpoint and Cisco ASA. I am bit confused with the NAT configuration in Palo Alto. Went through config guide and examples of NAT as well but still confused. We have a scenario as below. We have 3 zones - WAN, LAN and DMZ. Users want to reach DMZ interface from WAN an...

Resolved! Can log in PAN OS VM

I get this error when i try and log in OZ3-06-05 06 : 11.0Z5 -0700 Error :sysd_construct_sync_importer(sysd_sync .c : 360): sysd_sync_register() failed: (111) Unknown

file blocking profile not working for SFTP

Hii we are trying to access our internal storage using SFTP from internet. after applying file blocking profile we are able to access mentioned files but firewall not restrict the file. we found that file blocking is not happening. Please advise how to block files when using SFTP.

Discussions

SSL decryption - How to deal with third party sites that don't install the intermediate certificate?

Next Hop in default route using DHCP Comcast modem