VPN Tunnel from remote ASA: only one of three proxy-IDs working

Has anyone had an issue where a tunnel is configured with multiple proxy-id's for a policy-based peer, but a working security association is formed for only one of them?

I have a number of ASA 5505s that need to connect to my new Palo Altos from remo

Exception Handling in Palo Alto Support Page 7/22/2021

Hello Palo Alto Team,

I would like to bring this up with you.

I noticed that your support page went down today 7/22/2021 and that is fine. What worries me is the way your system handles exception. I think you are exposing to much that end user like m

Disabling bad checksum on Firewalls

Hi All,

We have received an request to disable the drop of packets due to bad checksum. I had the following questions on this:

Q1: Can i see in the traffic logs if any connections are dropped due to bad checksum.

Q2: This can be done by enterin

NAT SDWAN

Hello,

My Name is Dwi.

I have case with SD-WAN configuration.

I have 2 ISP DIA provider, and i want to combine 2 ISP provider in to single logical SD-WAN for Load Balancing Internet Traffic.

the Palo Alto device is under NAT, please help me to configure

Using GlobalProtect , ExpressVPN and Remote desktop

Dear All,

I am pondering following scenarios:

1- I connect to Server "S" using GlobalProtect on my Computer "A". Now Assume i do not have access to computer "A" physically because i have moved to another city. I want to access computer "A" from anoth

Why does URL Filtering Profile with a custom URL Category assigned require the same custom URL category assigned in a security rule to work?

Hi all,

Pardon me for the lengthy title.

Here is the layout of what I am working with:



• I am currently running PAN-3020 on PAN-OS 9.0.13
• I do not have a URL filtering licence 
• I do not yet do decryption (long story).
• Security rules are any/any for testi

inter-vsys vs shared virtual router

Hi all

It seems like 1 virtual router can be shared by multiple vsys

Reading up

https://knowledgebase.paloaltonetworks.com/servlet/fileField?entityId=ka10g000000UADEAA4&field=Attachment_1__Body__s

1 VSYS can have all multiple VR’s as well as multiple V

ECMP and PBF not work

we have a PA-820 with dual ISP internet (ethernet 2, ethernet 3)  and  ECMP. all PC 10.1.0.0/16 can load balancing through 2 Internet connection.

If I use PBF so PC 10.1.3.250 only go out through ISP 2( ethernet 3), I see this PC cant connect to Inter

10.0 user-id agent ignore_user_list not working

Since upgrading to pan os 10.0.6, we've noticed the "ignore_user_list" on our server user-id agents doesn't seem to be working.  We did not have any issues prior to upgrading to 10.0.x.  Has anyone else noticed this issue?  We upgraded our user-id ag

How to disable RSA/SHA1 on Palo alto device for SSH access

We are using OpenSSH v8.2 cannot connect to SSH hosts with SSH Proxy enabled (SSH Decryption).

Testing showing that this is due to the Palo Alto attempting to use RSA with SHA1 which has been removed by OpenSSH in v8.2.

Is there a way we can config

Http traffic to https

Hi Guys 
Can we redirect someone trying to access http://www.xxx.com to https://www.xxx.com ( port 80 to 443 ) ?

If we are using Dest NAT for https://www.xxx.com ? 

Thanks