Tenable Scan on Palo Alto firewall / Panorama

Hi All,

Are Tenable vulnerability scans (see below) on Palo Alto firewalls / Panorama resource intensive for the PA devices? Does this cause high DP or MP issues?

https://community.tenable.com/s/article/How-to-perform-a-compliance-scan-on-a-Palo-

NATting to a VM PAN secondary gateway behind a physical PAN

I've added a VM PAN to allow more Global Protect connections. It's working well for my cert based GP users. 

In the example below GP connects to 5.5.5.5, the 3220 PAN NATs that to an address on its DMZ 10.100.100.10

and the tunnels for like a champ. Th

HA Pair Config Sync issue

When we try to manually Sync the Active/Passive. HA Pair has local config sync error. This error is trying to sync the config between the two devices, but it's trying to sync local config (ie. management config) and not policies. I don't believe it s

Failed to backup mongo DB after upgrading to 10.1

Dear community,

After upgrading Panorama to Pan-Os 10.1 we get the following system log daily:

"Auto mongo backup: Failed to backup database 'pan_ms' collection 'msak':"

Any idea what is this error about and how to "silence" it?

Many thanks in advance

CLI - Regex with "?"

Hello all,

Does anybody know how to use a Regex that contains "?", obviously that doesn't work because that automatically triggers the helper?

For example, I'm trying to filter results for a certain CLI command using this:

| match (?s)(word1.*?)(?=wor

External Dynamic List error

Hello,

I have configured External Dynamic Lists by using Minemeld a few month ago. It was workinf fine.

The lists are available (tried from a web Browser)

I noticed that I have following system logs for a few weeks :

Unable to fetch external dynamic

Configure NTP to pull from AD server on window server 2019

Hi Everyone,

Can we configure NTP to pull the time from Window Server 2019 base AD server? I configured already and it seen to be able to reachable but unable to sync. There is no authentication configure. I tried the same on Cisco Switch and it able

vsys and subscriptions

If I add a subscription (say, URL Filtering) to the root vsys--do the other (non-root) vsys receive that capability as well?

I'm not finding that answer in the docs so far....

Thanks in advance,

JRP

security policy rule with URL filtering fails to trigger on targeted traffic

I am trying to make a rule hit on a custom URL filtering profile with HTTP header insertion for postman traffic to be allowed, so I created a URL filtering profile with a custom URL category in order to allow the specific URL ( /upload/ subdirectory