This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
General Topics
Post a discussion here if you have general questions regarding configuration and troubleshooting for Palo Alto Networks products. Use this forum to collaborate with like-minded security professionals to improve your security posture.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
General Topics
Post a discussion here if you have general questions regarding configuration and troubleshooting for Palo Alto Networks products. Use this forum to collaborate with like-minded security professionals to improve your security posture.
About General Topics
Post a discussion here if you have general questions regarding configuration and troubleshooting for Palo Alto Networks products. Use this forum to collaborate with like-minded security professionals to improve your security posture.

Discussions

Start a conversation

Active cluster

Hello , We have a customer having Active /active cluster . The Panorama lies in another country : The nodes of cluster use the traffic interface ( and not management interface)to reach Panorama , and at firewall we do the NAT , so that on Panorama natted IP is visible But for some reason , we only see 1 node connected and 2nd one disconnected ...

Resolved! Upgrading from 3220 to 3250

Is there a means of copying all configuration from a 3220 PAN to a 3250 including the certificates? The main impetus to upgrade would be to accommodate more Global Protect tunnels (2048 insteadof 1024.) I'm trying to understand what that migration might look like. TY

Firewall drops VSS-Management trailer due to Layer 4 checksum enabled

This is not an issue, but a general document about an issue that we experience with a customer last weekend. The issue is not well documented by Palo TAC and it took us the help of another customer who experienced the same issue with the same application vendor. One of our Electronic access systems stopped working after changing the perimeter fi...

VarunRao_0-1597719204504.png
VarunRao_1-1597720335639.png
VarunRao by • L2 Linker
  • 11879 Views
  • 7 replies
  • 4 Likes

File types need to block

The file type is malicious as per the swift advisory 2021, that need to be block on the Palo alto Firewall.File Type .gmu,.ekt, .jpn,.er,

SurajN by • L2 Linker
  • 2916 Views
  • 3 replies
  • 0 Likes

Communication between Panorama and a Firewall from outside

Hi PA Experts, We have a Panorama (10.02) that we will use to manage multiple firewalls from different companies, so it's a multi-tenant deployment. I have 2 questions for now: 1. One company is concerned about security connecting their FW to Panorama, though we explained to them it's encrypted. So they want to generate a certificate from their ...

Global Protect Single/One login Portal/Gateway

Good afternoon, I have a question: I have Global Protect configured and operating, operating correctly Portal and Gateway.When one uses the Global Protect App, it always asks 2 times for login, I understand that one is in the Global Protect Portal and then in the Global Protect Gateways. Is it possible that it only authenticates me once and does...

Metgatz by • L4 Transporter
  • 3325 Views
  • 1 replies
  • 0 Likes

Timeout on syslog sourced User-ID mappings?

Greetings all, Taking another look at our user-id mappings with our server team today and we've landed on trying 90 minutes for AD. We set this on the agents installed on two of our AD servers and the firewall is showing the new logs coming in as having the correct timeout. Next, I'm trying to figure out how to do this with our wireless. With ...

jsalmans by • L4 Transporter
  • 3225 Views
  • 2 replies
  • 0 Likes

PCI DSS testing failure

We are using SecurityMetrics to test for PCI compliance and have recently started receiving a failure based on TCP/IP Initial Sequence Number (ISN) Reuse Weakness (CVE-2002-1463) for the PaloAlto firewall (5.0.8).I'm not sure how to remedy the problem within the firewall. There have been no rule changes that should have caused this to start to o...

Resolved! Understanding Top Attackers Report

Hello, The Top Attackers reports lists:Source AddressSource Host NameSource UserCountIn a report I ran, all of our source addresses are internal addresses. Why is that? Is the report more of a top talkers report than an attackers report? In other words, is the report more of a list high activity accounts or addresses? Is the Count the number...

Jeff by • L1 Bithead
  • 11753 Views
  • 8 replies
  • 0 Likes

Unable to sign into GP client with Azure AD SSO

Hi All, Trying to setup Azure AD SSO with Global Protect, but am receiving the below error. According, to the Microsoft documentation it means that the user is not assigned to the application in Azure, but I can confirm that the user is assigned correctly to the application. Is there anything else I can check?Thanks in advance.

BenPrice_1-1638510522152.png
BenPrice_2-1638510770774.png
Ben-Price by • L4 Transporter
  • 8056 Views
  • 4 replies
  • 0 Likes

Resolved! Allow traffic to specified hosts/networks when Enforce GlobalProtect for Network Access Enabled

We've been troubleshooting some issues encountered when using the "Enforce GlobalProtect Connection for Network Access" option in our portal agent configuration. Our TAC engineer mentioned that he had seen a setting called "Allow traffic to specified hosts/networks when Enforce GlobalProtect Connection for Network Access is enabled and GlobalPr...

OwenFuller by • L4 Transporter
  • 26276 Views
  • 20 replies
  • 0 Likes
  • 24463 Posts
  • 125 Subscriptions
Top Solution Authors
View All
Top Liked Authors
View All
Labels
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks