General Topics

Threat Vector, a Unit 42 Podcast, is Now on LIVEcommunity!

We have some exciting community news to share: Threat Vector, a Unit 42 podcast, is now on LIVEcommunity!

Threat Vector is your compass in the world of cyberthreats. Listen to this biweekly podcast to learn about unique threat intelligence, cutting

...

How and Why to Accept a Solution to Your Post

Did you know that you can help your fellow community members by accepting solutions when a reply answers your question. Accepted solutions are a super-helpful resource in the community, and we want to make sure our members understand how this feature

...

Resolved! security rule placement

Hi All,

I have an outbound web-browsing rule, rule criteria is source zone (trust) destination zone (untrust) , application (web-browsing, ssl), service (tcp-80, tcp-443)

If you are going to create more application specific rules, does it makes more

...

What is the difference of security policy in session setup stage and fast path stage

Hi All,

Please could someone help me out in understanding this concept as I am a bit confused about this process.

I mean if App ID is ingonred then how is the traffic allowed to go to fast path stage if all the rules are configured using AppID rather

...

Zabbix Monitoring PA-7050 via SNMP v3

Hello.

I have a couple of PA-7050 firewalls that I monitor from Solarwinds Orion via snmp v3. However, when I try to monitor those same devices via Zabbix (SNMP v3), I am unable to get an SNMP response via the Zabbix application. SNMPwalk works fin

...

Resolved! DNS Proxy/Security

I was curious to know if anyone was pointing their domain controllers to the firewall for DNS security/proxy? Mine currently use the ISP, but the clients use the firewalls as a proxy and then just rule just forward internal domains to the DC. Seems

...

CobaltStrike.Gen Command and Control Traffic(18005)

Hi Team,

Just want to enquire if this particular signature marked as "Critical" severity has any False positive reporting ?

Interested to know what are the strings used

Resolved! Wildfire without SSL Decryption

We are looking at Wildfire for our PA firewalls however, we are not doing any SSL decryption. Going into it I figured we only be and to use it on unencrypted traffic. But looking at the Wildfire datasheet under file support it lists TLS and SSL files

...

Resolved! You don't have permission to access "http://www.costco.com/" on this server.

There are certain websites that I cannot visit behind the firewall, and get errors saying You don't have permission to access XYZ on this server. In this case, I cannot visit www.costco.com

I am accessing with https/

Has anyone figured out how to re

...

Resolved! PAN routing IPv6 traffic to UnTrust with default route pointing elsewhere

I have a PAN on the internet with only IPv4. I have an ASA dual stacked that I want to send IPv6 traffic from hosts connected behind the PAN to the ASA via the LAN. All the interfaces on the PAN in the path have IPv6 configured. However, when the p

...

Resolved! Regarding sinkholed hosts

Hello Bros,

We have subscribed to palo alto dns-security and the license has been applied to the device.

Rules with anti-spyware "dns-security sinkhole action enabled".

Now regarding the hosts with sinkhole action, that means these hosts trying to c

...

Issue CDN and AVG Update

Hallo Community,

I have an issue about AVG and CDN. I used PA 220 with Detials :

Software Version10.0.6Application Version8435-6846 (07/27/21)Threat Version8435-6846 (07/27/21)Antivirus Version3791-4302 (07/28/21)NetworkLayer 3

1. AVG Update

Regarding

...

PA-5250-AC Policy Rule, Service: Application-default for DNS Application

I have my PA-5250-AC with below sample rule. As per checking the traffic logs, I found out that UDP 53 is hitting rule 2 while TCP 53 is hitting rule 1. what is the possible cause?

No.

Source

Destination

Application

Service

1

A

B

…

dns

…

...

Verify pdf report sent via email scheduler

We have configured email scheduler to send reports in pdf format.

I'm able to receive the email. But attachment is missing.

I can see from system logs that the files are created and email is sent.

How can I verify whether the PDF report was attached to

...

Paloalto don t send log correctly to logstash

Hi evrey one,
I'am new to Paloalto and I have a problem with the threath log. I am currently using ELK stack to store and visualize all log from paloalto.
When I send the traffic log to logstash there is no problem (there are all field explained in th

...

Global protect not working

Hi Team,

We have faced our GP not working 26/07/2021 around 09:15 pm.

After the firewall restarts its started to work. When I analyzing TSF I got the ssl vpn below error.

"The PID for this process changed indicating it was restarted"

2021-07-26 21:17

...

New 5220 non-functional state

New HA 5220 active-active and non-functional status.

HA-1 and HA-2 cable attached

Set up box boxes direct mode and then created templates via Panorama

Panorama doesn't display to parameters defined in direct config status

How to ensure configs are dumped

...

Discussions

Threat Vector, a Unit 42 Podcast, is Now on LIVEcommunity!