General Topics

What is the difference in function between the Global Protect Content Filter and the Cortex XDR content filter

On Mac (but I assume something similar exists on PC), both Cortex XDR and Global Protect install a content filter agent. What is the differnce in function between these 2 agents? If I remove the Global Protect agent do I still benefit from the same level of protection solely with the Cortex XDR agent?

pan os 10.2.4 advanced routing engine static route issues, a bug?

Hi guys, I have logged the case with palo alto with 'no issues found' response I would like to ask if anyone can kindly test for me I have converted to an advanced routing engine (pan os 10.2.4) conversion when fine, no issues, green light upon conversion results all my static routes stopped working after that, they are like being ignore...

SCEP for firewall device cert?

We do not currently have SCEP set up in our environment nor are we familiar with it. But if we did have it set up would our PA firewalls be able to request a cert that we could then use in a SSL/TLS service profile to have a secure connection between our computers and the mgmt gui of the PA? Deploy Certificates Using SCEP (paloaltonetworks.com...

Resolved! URL Blank in Traffic Logs

The traffic logs for our PAs almost never actually show a URL, despite the URL category getting properly assigned. The only time I ever see a URL show up in the logs is if it is specifically denied because of the URL category, which is fairly rare. If they are allowed, or blocked based on something else like application, no URL shows. Is this ex...

Resolved! Accessing A New Palo Alto Firewall In The GCP

Experts., We have a virtual Palo Alto firewall (BYOL) in the GCP and were able to change password using the initial access and the ppk file.We provisioned one more VM firewall in same GCP setup, however this time we are unable to recreate the steps we had done earlier After the instance is provisioned we have configured ssh key in GCP and from o...

Resolved! About User-ID Agent

Hello, I've been practicing Palo Alto lately, I'm having trouble setting up "User-ID Agent"...This is my simple structure : I set up "AD server" and "User-ID Agent" on the same Winserver I also added Win10 to domain, and gave it an account (michael) But I don't know why "User-IS Agent" always identify the IP of "michael" as 10.20.54.52 ,inste...

Issue with finding palo alto self-signed certificate under certificate menu

Hi there, Management web is using palo alto self signed certificate but I'm not able to find it under certificate menu in device section. Any one has faced this issue before? It should be somewhere in configuration refer to self-signed certificate, if I want to create a self-signed certificate by myself I'm able to see that certificate under...

Connect same VLAN to multiple V-SYS

Hi All, We have a PA-5220 firewall cluster which has running multiple V-SYS itself. The firewall is connected to the up stream router thru a port channel. On the up-stream router VLAN 10 is allocated to the WAN-IP range. I need to extend that VLAN 10 to the V-SYS A and V-SYS B so I can can assign the respective public IP addresses to the diffe...

PBF not working with DNAT policy for server

Dear Team, We have 5 ISPs and we have configured PBF for a group of IPs/networks. We observed while routing the server from X ISP to Y ISP, the server which is published on X ISP becomes inaccessible. Request you please help to resolve the issue on a priority basis.

Resolved! USER-ID mapping by firewall

Hi All, Consider there is an user ([email protected]) is accessing some network for which communication is allowed in firewall based on USER-ID rules. If the User([email protected]) at the same times access the allowed sites by using two different IP address, will the communication from both the machines would be allowed.

SNMP Counter issue

Hello everyone I am having a problem with SNMP requests on my palo-alto. My issue is the following I don't see any traffic on the physical interfaces of the palo alto, the traffic remains at 0 I can clearly see the traffic on the virtual interface (VLAN). I am on zabbix My palo alto is a PA-440

Panorama config export fail. Host key verification fails

When I try and configure a scheduled config export the connection fails. I get a message the RSA host key differs and asked to confirm adding the key. This is a loop and always asks to add the key. If I try to remove all the known host keys the command ( delete user-file ssh-known-hosts) completes but does not seem to delete anything. The sa...

Resolved! panos 10.2.4 palo alto no grpc connection available under iot policy recommendation

hi all, every time I click on device->policy recommendation - Iot i get an error "no grpc connection available" what does this error mean Thank you

comments in cli

Hi I have a text file with PANOS command line arguments (set) what character defines a comment line ? is there one ?

Resolved! PA is connected to a router

Hi PA(non-management interface) is connected to a router via a cable . What is minimus condition for the two device to ping each other? 1. ip address in interface are in same subnet, 2. interface associated with management profile to allow ping 3. interface type is L3 Any else? The reason why i ask the question is the two device cannot s...

Discussions

What is the difference in function between the Global Protect Content Filter and the Cortex XDR content filter

pan os 10.2.4 advanced routing engine static route issues, a bug?