firewall is preferring a higher cost route even though its learning lower cost route with same type in ospf.

Global Protect AutoVPN and Windows 10 Login Screen

When I login to my laptop computer - underneath my user name for sign in SOMETIMES is the statusmessage: GlobalProtect Status: Connected (and under it the name of the GP portal/gateway.) But at other times I see no such message or "sign in options". If sign on options are there one includes the GP logo w check on it. A third issue now I've seen...

User-ID agent

We have User-ID agent installed on windows VM server. We want to increas the RAM on this VM to improve the performance. If I shutdown this VM, what will be the impact on user authentication during VM remain shut down? Please refer me to some KB so that I can do this activity.

Getting Low Speed

Guys, My Lan users are getting a slow downloading speed. I have checked the ISP cable directly and there I am getting the accurate speed which is 30Mbps. But when I am connecting the ISP cable to Paloalto after that I am running the speed test it's gives me only 4 Mbps. I have tested also one pc with no URL filtering or no profiles applied on it...

IPSec tunnel to Azure - Strange issue

HI all, I have an active ticket with PA but struggling to get through to anyone atm. We have recently made some routing changes and moved the Azure IPSec tunnel from an SRX to a PA. The tunnel came up fine but we are having a weird issue with RDP. It's like the tunnel is only allowing so many sessions across. Some users have to try about 10 time...

wrong user-id mapping

Hello everybody,We have a problem with a user to IP mapping. Doesn't matter which version of PanOS - 7 or 8, doesn't matter if it's using windows agent or direct access from paloalto to LDAP servers. Let's say a user is going to some server, windows exchange for example, and this server authenticates the user by LDAP. Then windows agent will...

Panorama rest-api edit security policy post rule - 400 Unexpected here

Hi! I'm writing a python script to change the security profile for any security policy rule that is using that profile (very tedious to manually click through hundreds of policys via GUI). Panorama rest-api is always throwing a 400 response to me:URL query parameters and response:location=device-group&device-group=firewall-fw&name=rule-t...

L3Svr Restarting automatically

Hi Team, The l3svc process is restarting automatically whenever we are doing an commit on the firewall. This is sometime causing captive portal to not work correctly. Is this an bug. We are having PAN-OS 9.1.10 currently installed on the firewall and the firewall is active in Active/Passive HA mode and the firewall model is PA-3220. masterd.log2...

SSLlabs test is blocked on decryption with F5 passthrough

https://live.paloaltonetworks.com/t5/general-topics/extra-certs-inbound-decryption/m-p/457936Adding to the previous discussion with same setup where PA is doing decryption and the F5 is doing SSL bridging/offload while proxying for the server behind it. If we do SSL bridging/offload SSLlabs test goes fine with PA doing decryption and F5 will pr...

Custom URL Categories - ending tokens

Let's say we want to match a domain in a custom URL category or EDL, including all sub-domains. While most people would expect "youtube.com" to do the job, in a PAN-OS this would only match youtube.com and not content.youtube.com. To achieve the result we must include:youtube.com*.youtube.comI can live with that... however in PAN-OS 10 admins ar...

QoS priority - 'real-time' vs 'high'

Hi, What is the difference between 'real-time' and 'high' priority than? Will there be any difference under similar circumstances when you have 100 Mbit/s MAX egress and 50 Mbit/s guarantee, while actual traffic matching this class exceeding 100 Mbit/s? Previously I was under impression that real-time one will just drop traffic exceeding queue l...

User Mapping on Mac with M1 chip in domain

Hi All,I joined Macbook on m1 chip to the domain and the firewall don't recognize user (Don't work user-mapping). I can't apply policy which works via users. We have 3 Mac's on m1 chip with the same problem. Also checked on Mac with intel - no problem with user-mapping after join Mac to domain. Maybe someone has already met such a problem. Thanks.