General Topics

Introducing the LIVEcommunity Support FAQ: Your Valuable Customer Resource

LIVEcommunity is thrilled to introduce its new Support FAQ section, designed to help Palo Alto Networks customers quickly resolve their common queries.

You'll find this new area under the Articles section of the main menu:

Our goal is simple:

...

How do the 5450 logical card slots and associations work?

I see the documentation that shows information regarding slot 1 and slot 3 and how a NPC associates to a DPC. And if you add a NPC to slot 2 it will associate to a DPC in slot 4. What I don't see is if you add more DPC's, how that associates to t

...

Resolved! PAN URL DB not getting update.

Hi Team,

I have 3 firewalls in my different loctions, All 2 firewall URL Update version is up to date. Only one firewall is a lower version.

Also, I identified lower version firewall having a different update server when I checked the show url-cloud

...

Resolved! End-of-Life Date 8.0 - October 31, 2019

Hi,

I found, what End-of-Life Date for PAN-OS 8.0 is October 31, 2019

https://www.paloaltonetworks.com/services/support/end-of-life-announcements/end-of-life-summary

We are using version 8.0.13 with active subscriptions.

1. Will we receive updates (Ant

...

Portal Page for internal authentication, with certificat download

Hello Bros'

I am running into a new configuration required for my palo alto setup.

Due to changes we need to make traffic decryption for unmanaged network over virtual wire setup "in/out".

to decrypt this traffic we need to distribuit th

...

Resolved! Management interface is down.

I found on my firewall that management interface is not able to communicate with LDAP server and so on. From the GUI it look everything is configured correctly but when I switched to CLI, I found that management interface is down.

Link status:
  Runti

...

Resolved! Cannot Access Web Server External Only Internally

Hello,

I am trying to deploy a new PA850 and I am unable to access any web servers externally. I can access internally using the public IP using I believe the u-turn policy. Any help would be appreciated Thank You, MJF

Screen Shot 2021-10-29 at 10.14.43 AM.png

Screen Shot 2021-10-29 at 10.15.04 AM.png

Disable weak cipher suite in SSH

I would like to disable weak cipher suite in SSH for over 100+ Firewalls with the following commands. The firewalls are running in High-Availability (H/A) mode, version 9.1.10:

configure
set deviceconfig system ssh ciphers mgmt aes256-ctr
set deviceco

...

User mapping not happening properly

We have recently added a user in the server list.

We are able to see the user in LDAP but when it comes to firewall we are not able to see the user in security policy.

When i checked the user with following command

show user ip-user-mapping all | match

...

Resolved! Globalprotect Portal same IP w/ management interface

Hello,

Before setting up globalprotect portal, I could access the management interface using the public IP externally. Once I configured globalprotect portal for VPN, the IP now directs you to globalprotect welcome login page. Which is normal, cause I

...

Generated traffic logs showing weird information

I have a VM-500 panos-8.1.18. I am seeing traffic logs with below flags

Session End Reason- policy-deny (means traffic denied as per policy)

Action -Allow ( how can action be allowed when traffic is denied via policy)

Type- deny

We also have ssl decrypt

...

Configure secrets/psk with Ansible 'panos_type_cmd'

Hi,

When using paloaltonetworks.panos collection - module 'panos_type_cmd' is there any way to set secrets or psk without using the real password?

Configuring via plaintext password works fine and then when viewing the xml config the passwords are st

...

How do I set bgp auth-profile secret in XML?

<auth-profile>

<secret>-AQ==9wW2MMYTyjIArw6U5IgQlTHDTnc=zwKe7XpB+qQLdlenAO8tkg==</secret>

</entry>

</auth-profile>

The configuration appears to be encrypted, maybe using the master key or something. Is there anyway to set this in XML c

...

Resolved! IKE Error

In my system logs I'm seeing the following error:

"IKE phase 1 negotiation is failed. Couldn’t find configuration for IKE phase-1 request for peer IP x.x.x.226[500]."

The bizarre thing is that the tunnel IS working despite this error!!!

The reason fo

...

Can we use SFP+ with PA-820?

Hi, Guys. I plan to use the PA-820.
The PA-820 has only two HA ports.
I am planning to substitute the HA ports with SFP ports.
Can I use the PAN-SFP-PLUS-CU-5M with the PA-820?
The PAN-SFP-PLUS-CU-5M is cheaper than the PAN-SFP-CG, so I would like to use

...

Palo Alto IPV6 configuration for firewalls running in active-active HA

Hello All,

We have a customer planning to enable IPV6 firewalling in their current data center firewalls. The firewalls are currently running in active-active HA mode. I have the below queries.

1. When I configure IPV6 address on the interfaces, is

...

Discussions

Introducing the LIVEcommunity Support FAQ: Your Valuable Customer Resource