General Topics

Resolved! Can "Decryption Mirroring" forward non-encryption traffic?

I am planning to forward all traffic to traffic collection tool. As I know there are "Decryption Mirroring" (https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/decryption/decryption-concepts/decryption-mirroring.html) and it will forward the traffic after decryption.I would like to know if the traffic is non-encrypted traffic such as htt...

Network segmentation via routers VRFs to Palos VRs and OSPF

Hello everyone and thank you for your answers, I would like to implement segmentation in the data center, we will create VRFs in a Cisco Nexus Core switch and each VRF will have its own OSPF process to peer with a Palo Alto Firewall, all VRF traffic needs to go through the Palos for policy and routing, the question is: -Should we create multiple...

Very weird PanOS upgrade issue

We have a pair of active passive firewalls on PanOS 9.0.11. We have attempted to upgrade to 9.1.10 4 times out of which 2 times was with tech support. Upgrade seems to cause issue with some linux servers which are critical to us. As an example we have system running Nagios which starts alerting immediately for number of devices. And when we try ...

Global Protect version 5.2.8 - issue with Microsoft Defender ATP

Hello We have a issue with Global Protect, we have upgrade to 5.2.8 and the AV Microsoft Defender ATP is not work properly: In the last version (5.2.5), there is no problem with AV:

Resolved! Block accessing PA CLI or web interface when work from home via Global Protect

Hi Team, Usually we are working from office and there is no issue when accessing PA CLI or web interface.Now when we are working from home and connecting to GP, we still can access and is there any ways to block the access? If we are not connecting to GP, there is no issue.

Miner for salesforce.com

Hi Team, Can you please advise how to build a miner to map all salesforce.com IP's?

Globalprotect client losing dns intermittently

hello everyone We have a intermittently issue with GlobalProtect client and the local DNS resolution. We have conigured local dns servers on network services and we have established "Resolve All FQDNs Using DNS Servers Assigned by the Tunnel (Windows Only)": YEThis configuration is working fine, but intermittently, the local DNS servers are not ...

Inbound traffic to DMZ issue

We have reports of certain users not being able to access our public website but majority of users are able to. The traffic log shows that the application is incomplete. Packet capture reveals the 3-way handshake does not complete and the session times out. The same person who is NOT able to access the public website is able to access another we...

Resolved! Can PA firewall work as Explicit proxy

Dear All,Can Palo Alto firewall works as explicit proxy for internal usets ? Appreciate sharing official article .

VPN IPSec Configuration Disappeared from GUI

An issue where I can’t view any configured IPSec Tunnels in GUI,From CLI, the IPSec tunnels appear normally. Tried failover, restarting management service, even rebooting both Palo Alto units, using different browsers, different computers, and export; import and load the configuration file with no success. Device Model: PA-5220 HA Mode Active-st...

PA-850 Migration to 10Gb SFP+ Interface

Hi, I have a customer who was a PA-850 firewall. There connection to their LAN is currently using a 1Gb Ethernet port (Port 4). They are in the process of upgrading the network backbone to be 10Gb and wanted to change their connection to the Firewall to 10Gb too. Is there any easy way to migrate all of the settings they have setup from port 4 to...

Resolved! Block Windows 7

I am trying to block Windows 7 clients from accessing the internet. I have followed the steps here: https://live.paloaltonetworks.com/t5/Configuration-Articles/Custom-vulnerability-signature-for-identifying-Windows-XP/tac-p/72273#M1496but I am unclear on what to set for the Pattern. Any suggestions/help to accomplish that goal will be apprecia...

GlobalProtect and "client sleep mode"

Hello,as described in the "GlobalProtect 1.1.6: Addressed Issues" (issue point 35361) the unnecessarily reconnection after sleep/hibernate mode should be fixed.We are using the GlobalProtect Version 1.1.7 . The portal configuration are:"On demand" mode, as authentication "certificate profile" only,single sign-on on, agent user override disabled,...

Resolved! Custom App for CRL downloads

Hi,I am trying to create a custom app that will match CRL downloads, to allow them without any questions ask. Shouldn't be too hard : on a previous web security gateway, I would match a pattern like the following: "http://([^/:])*crl.*\.crl"When translated to an app signature, I already know I am looking for two patterns, on the following contex...

Resolved! PAN-OS 9.1.11-h3 upgrade file

Hi support, May I know the upgrade file for PAN-OS 9.1.11-h3? I could not confirm it. Below is my environmentPA-5200 platformVM seriesPanorama M images Thanks !!!

Discussions