General Topics

Fuel User Group is Now Part of LIVEcommunity – Connect & Learn for Free

Hey Everyone!

The Fuel User Group is now part of LIVEcommunity! If you haven’t come across Fuel before, it’s a space where you can connect with fellow cybersecurity folk, share knowledge, and learn from each other. It’s completely free as well! Fue

...

Welcome to the General Topics Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating:

Rules and Best Practices

Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussion

...

How do I remove KEX diffie-hellman-group1-sha1 from SSH on PAN-OS 8.1?

Our vulnerability scanner has detected a weak KEX algorithm (diffie-hellman-group1-sha1) on our firewall. Is there a persistent way to disable the weak KEX algorithm?

I found this article (below), but it says every time the firewall reboots the weak

...

Resolved! User-ID-Agent wrong mapping with specific IPs

Hello,
since a few days we see strange things with User-ID-agent.
For some specific IP-addresses there are shown wrong users. This users even are not in the internal AD, they are just external VPN users invited from Azure. But they are mapped to intern

...

Global Protect error Windows 7 Client

Good afternoon, first of all thank you very much for the help and support for this case:

"The virtual adapter was not set up correctly due to a delay. GlobalProtect will try again soon. If the issue persists, please restart your system"

-Windows vers

...

Error_Gprotect_Win7_2021-08-24 at 17.52.48.jpeg

Resolved! VPN to AWS with BGP

Hello,

I have 3 locations that I need to create VPNs to AWS for. Each location is dual ISP using PBF. Since AWS uses 2 tunnels each VPN connection, seems there will be 4 total tunnels per location (2 per ISP). My initial thought was to use stat

...

bgp cmd

Hi All ,

Just checking what cmd we can use to validate receive and adversities BGP route from a peer like we have in cisco .

@PavelK

Palo Alto Networks Approved

Resolved! Security Policy - US access only

Hello,

I'm trying to configure a Security Policy to only allow US-region IP addresses to hit our network. I added as a first rule to allow any untrust us region to destination untrust US region. I am not sure if this is correct. maybe I'm allowin

...

Deploy GlobalProtect pkg to Mac devices via Microsoft Intune

Has anyone had success deploying the GlobalProtect.pkg (5.2.9-35) to Mac devices via Intune? I upload the pkg file to Intune and assign the app. It successfully installs GlobalProtect but it then runs the uninstaller as well, removing GlobalProtect f

...

Resolved! Firewall is not forwarding logs to Panorama

Hi Folks,

We have PA-3250 firewall deployed in our environment managed by Panorama.

The panorama is deployed in Panorama mode and the firewall is under panorama and no connectivity issue between firewall and Panorama.

The firewall is also added

...

L2TP over IPSec PAN-OS 8.1.11

L2TP over PAN-OS 8.1.11 with
IPSec is supported in PAN-OS 8.1.11?

When I check the traffic log, the reason for session termination is "aged-out" and I am unable to make a VPN connection.

I have Virtual Wire set up, but I would like to know if anyo

...

Can we continue to check domain and antivirus if GP license expired

In Global Protect HIP check we have allowed only specific domain machine and specific antivirus. Firewall will continue to check domain and antivirus if Global Protect license is expired ?

Any impact if GP license expired ? Do we require to remove HI

...

GlobalProtect Silent Install

We are currently in the stages of switching over our equipment to palo alto. In preparation, we are installing the global protect app on all machines ahead of the migration. I've got a silent install setup, but once it completes, I get a connection f

...

Resolved! unkown-tcp/udp session timeout?

Dear all,

What is the session timeout for unknown-tcp/udp?

Since this is an application which has no values set for timeout, can I conclude it will use the default-tcp/udp timeouts?

Kind regards

OpenVPN support on Palo gateways?

Palo gateways have supported ipsec site to site vpn for a long time. Do they also support acting as an OpenVPN gateway? I dont mean openvpn passthrough to a backend. I mean actually being the Openvpn endpoint.

Resolved! Found a PA 200 in the trash

Hi, i found a PA 200 in the trash, it works fine, is it viable to use it as a firewall. I don't have access to any support at all. Not even a os update of some kind. And is there any way i can get said update. Have a great day.

revert but not the config

Is there a way to "revert" via cli? I don't mean config changes either, I mean like the following places:

1. Network > Interfaces > Ethernet1/1

2. Device > Setup > Management

I'd like to script out reverting these.

General Topics

Discussions

Fuel User Group is Now Part of LIVEcommunity – Connect & Learn for Free