Why Destination NAT is not working for internal users.

Why Destination NAT is not working for internal users. Why need to create U-Turn NAT if we have existing Destination NAT created and if internal users want to access it.

Identify the user account while using RDP on desktop

Hi,This is just an query, so that I can understand this topic better. Bear with me, since I am not a network specialist.EnvironmentUser works remotely on a laptop and uses GlobalProtect VPN client to remote in on a desktopThe desktop is located in the office, which allows the user to RDP in on it from any location outside the officeThe desktop i...

Multiple IKE crypto profiles on individual interfaces for multiple IPSEC tunnels

Hi, In 2021 we ran into the issue where it seemed between PA-OS 8.1.x and 9.0.x/9.1.x Palo began either via a feature or bug introduced began enforcing the scenario in the subject line and began dropping tunnels after upgrading and causing issues with HA pairs. Define IKE Crypto Profiles (paloaltonetworks.com) At the time Palo identified the abo...

Is it possible to DDoS/DoS a public IP which has only outbound traffic and ipsec tunnel. No DNAT configured and ping disabled.

Multiple IPSec tunnels, single external IP

Looking to set up a POC with a PA-820 that has the followingIPSec VPN site-to-site between our local facility and 3 partner networksSingle external IP, 3 tunnels (IKE P2)NAT to a single host on our local private networkIs this reasonable/possible?

details logs traffic report generating issue

I'm trying to fetch report custom for traffic details log ,but it not generating .summary logs report for traffic is generating. pan os version 9.0.9-h1 .PA-3250 model.

Failed exporting config bundle via ssh

Failed exporting config bundle via ssh to servername.com /tmp/pan/pano_name_20220106.tgz: No such file or directory..Killed by signal 1..' It was working, but suddenly has stopped. "Test SCP server connection" works and drops the test file in the correct location. Scheduled Config Export job fails with the above error however. Any ideas on how...

PRISMA SD-WAN

Is Palo Alto dropping support for PRISMA SDWAN? A lot of the older but detailed CG branded docs are gone, but there are no new Palo Docs to replace them? I'm interested in implementing the Cloudblades, and all the site links take me in a loop of marketing material, and explanations of how great it is, but I can't find one doc that even list ...

Where do you get additional threat feeds from

Hello All,Just curious as to what additional threat feeds you use to ingest into your PAN. Here are some of the ones we use:Threat intelligence blocklistshttps://talosintelligence.com/documents/ip-blacklisthttp://rules.emergingthreats.net/fwrules/emerging-Block-IPs.txthttp://panwdbl.appspot.com/http://www.spamhaus.org/drop/drop.txthttp://www.spa...

FQDN URLs that change IP addresses quickly

PA-3220 Active/Standby Pair10.0.8-h8 We have a URL we tried adding to a negate policy for inside to outside decryption. This resolves the ability to pull credit reports into our core financial system. However the problem is still intermittent. Its added as an FQDN object. Here's the thing, If I do an nslookup or go to digwebinterface.com and ...