General Topics
Post a discussion here if you have general questions regarding configuration and troubleshooting for Palo Alto Networks products. Use this forum to collaborate with like-minded security professionals to improve your security posture.
cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
General Topics
Post a discussion here if you have general questions regarding configuration and troubleshooting for Palo Alto Networks products. Use this forum to collaborate with like-minded security professionals to improve your security posture.
About General Topics
Post a discussion here if you have general questions regarding configuration and troubleshooting for Palo Alto Networks products. Use this forum to collaborate with like-minded security professionals to improve your security posture.

Discussions

Discover LIVEcommunity Through Our New Animated Explainer Video!

 

We’re thrilled to unveil a brand-new animated video that highlights everything LIVEcommunity has to offer! 

 

This short and engaging video gives you a quick tour of the many resources available in our vibrant community — from interactive discussi

...

kiwi_0-1745308399217.png
kiwi by Community Team Member
  • 1661 Views
  • 0 replies
  • 0 Likes

Resolved! How to add/delete host keys

Hello,

I was testing out different SCP servers to export logs from the PA firewall, but I got this message after my third SCP server:

<user>@PA2050> scp export logdb to <user>@10.200.168.158:logdb
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

...

sonet by L2 Linker
  • 10025 Views
  • 2 replies
  • 0 Likes

Resolved! IKEV2 w Cert - Wildcard peer for DN does not work.

Can someone please give me the format you are using for the peer id using DN with a wildcard. CN= ??

 

I try 

CN=*

CN=lab-fw-vyos-*

 

The DN in the logs coming in from the peer is

lab-fw-vyos-testsite

 

when I try CN=lab-fw-vyos-testsite it works but

...

building a lab with PA-440 or VMs

Hello everyone,

 

I have some knowledge about PaloAlto NGFW but now I intend to focus and get some certifications. For that I bought a PA-440 which runs 11.2.5 and I intend to buy a second one which doesn't have an active license and running 10.2.3-h

...

No internet after changing ISP

PA-440, OS 10.1.14, Standalone

We just changed the ISP, the static IP in interface (WAN), updated the Virtual Router as well, NAT, PBF, Security Policy was checked, IKE Gateway.

But we couldn't browse the internet. The firewall management GUI is also

...

Dars_Em by L1 Bithead
  • 1243 Views
  • 7 replies
  • 0 Likes

Resolved! how to whitelist Akamai downloads ?

How do yuo configure a correct FW rule to only allow downloads for a specific user from a specific URL, but the content is hosted on akamai networks ?

 

I configred a FW rule with the URL of the server as FQDN in the destination field and allowed downl

...

DaxVC by L2 Linker
  • 13234 Views
  • 6 replies
  • 0 Likes

Resolved! Proper "outside" interface configuration

Hello all!

I'm facing an issue which brings me to ask what the proper configuration should be for an outside interface.

 

Given the attached diagram and captures, do I have the correct outside interface (vlan.100) configuration?

 

diagram

 

  • Outbound t
...

if-cfg-question_202504151350.jpg
2025-04-15_14-15-22.jpg
2025-04-15_14-04-22.jpg
2025-04-15_13-52-51.jpg
relayer by L1 Bithead
  • 1888 Views
  • 5 replies
  • 0 Likes

ACME and SSL decryption

So i recently got wind of this:

 

https://www.thesslstore.com/blog/47-day-ssl-certificate-validity-by-2029/

 

acme.sh and/or certbot takes care of the servers, but won't this break existing SSL decryption rules?

Any strategies/workarounds for this? t

...

Resolved! Clarification on http2 traffic and decryption

Hi all,

 

I was hoping to get some clarification on http2 and firewall interaction. I understand that generally http2 works without issue as long as it's being decrypted. I also understand disabling inspection/decryption (Strip TLS ALPN) on http2 tra

...

KGDrake by L0 Member
  • 2766 Views
  • 2 replies
  • 0 Likes

Resolved! Best method to block Instant Messaging

Working for a State Government agency, we are required to keep a record of any official electronic communication.  Using public Instant Messaging services creates a problem for us in that we don't have a mechanism for keeping copies of any transactio

...

merrydc by L1 Bithead
  • 4943 Views
  • 4 replies
  • 0 Likes

GP/ LDAP authentication

Hi, 

 

I have a test AD/PA setup.

AD and LDAP connectivity is okay so far.

 

My problem is that I am unable to authenticate any user against Global Protect.

The un/pw are correct.

The group are correct too, as far as I can see.

 

This is the output i get when

...

Vimz888 by L1 Bithead
  • 3679 Views
  • 4 replies
  • 0 Likes
  • 24215 Posts
  • 117 Subscriptions
Top Solution Authors
Top Liked Authors
Labels