General Topics

Remote backup issue

I am trying to backup the config from a remote backup server. The backup file is generating but no config showing in the file. Instead when I open the xml file, I can see this " <?xml version="1.0"?> -<response code="403" status="error"> -<result> <msg>Type [export] not authorized for user role.</msg> " The st...

Kerberos SSO for Captive Portal

Been working through options for gathering userID data on non-domain-joined machines lately, so here's another complete option using Kerberos (krb) SSO. Create a user in AD (my example, username: krb.palo), check the boxes for:User cannot change passwordPassword never expiresThis account supports Kerberos AES 256 bit encryptionNOTE: this account...

Resolved! Best practice to write an application based policy whith some ports different from standard

Hello,I would need to write a policy to allow Oracle connection on specific servers.Unfortunately I have some Oracle instances that don't use the standard TCP 1521 port.How can I handle this problem writing just one rules that matches all my destination Oracle servers even if there are different port used? Thanks for your reccomendations Regards

Resolved! user-id not mapping

Hello community, I'm facing an issue with user-id agentless. i did the following configurations Create LDAP Server Profile LDAP/Group Mappings configured on FW User-ID Group Mapping Settings. server monotoring is connected Include network set User ID on the source Zone enabled account service on AD with the differents rights : events log read...

Resolved! about session offload

Hello the purpose is to minimze the cpu consomption but in wich way ?how the offload work exactly?thank's

Resolved! Log collector drive bays question

Hey all,I need to replace a disk on a Palo Alto M600 log collector There are no disk labels on the device. Could anybody here confirm which bays are A1/A2 and B1/B2? I've attached a photo. I'm guessing A1 starts the top left but I' not sure. #m600

Resolved! Missing PANGPS Virtual Ethernet Adapter

When launching Global Protect for the first time, the computer will prompt for the portal to connect to. The portal information will be enter and when hitting connect it will only display "Connecting...". It will not get to the username and password login screen. While working on the computer, it was identified that the PANGPS Virtual Ethernet A...

How to access Management interface through host name

I want configure wild card certificate to management interface through SSL/TSL profile. so i want to access this management interface through host name. how to configure this on Palo alto.

Decrypted flag under Monitor Logs

Is it normal to see Decrypted flag as yes even when there is no decryption policy configured.So what traffic will PA decrypt even when there is no decrypt policy?

Resolved! Error in parsing xml response

Trying to log into my FW, and keep getting this message

Hardware Features on Entry Level Devices

PaloAlto Needs to consider some physical features to be included in the SMB sector cleints. A competitor is preferred because of including more ports in their entry level devices including SFP (10GE) slots

Resolved! Captive portal not working in Chrome and Edge after updating to PAN OS 10.1.2

Hi All, I have an issue where captive portal isn't working in Chrome 92.0.4515-159 and Edge 92.0.902.84 after updating to PAN OS 10.1.2. Captive portal is still working in IE 11 and Firefox 91.0.2 though. Receiving the below error in Chrome and a similar error in Edge:Has anyone come across this issue? It seems as though it may be a bug? Any ideas?

Resolved! QoS - Is "Real-Time" Priority a Strict Priority Queue?

So I have two questions regarding PAN QoS when you use class 1 (or any class) and configure it with a priority of "real-time".1) I assume Real-Time makes it a priority queue. Is it a STRICT priority queue? (Meaning that whatever you set that rate for, if there's more of that type traffic than what the rate is, even if THERE IS available bandwidt...

cli access with email usernames

Has anyone been able to authenticate to the CLI using a username such as [email protected] over SSH using TACACS+ as authentication. Authenticating using the WebUI works fine, but when you try to SSH using ssh [email protected]@ipaddress it just sends you back to the username screen. ( user is a superadmin role)

Is Azure’s infrastructure safe and secure?

I am looking for Azure training to become a certified professional from one of the leading online earning platform as recommended by one of my friends. Before that I was looking on the internet for some facts like azure security. Many customers have seen that safeguarding their data center infrastructure will require massive amounts of money an...

Discussions

Remote backup issue

Kerberos SSO for Captive Portal