This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
General Topics
Post a discussion here if you have general questions regarding configuration and troubleshooting for Palo Alto Networks products. Use this forum to collaborate with like-minded security professionals to improve your security posture.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Scheduled Maintenance: November 14–15 (starting Nov. 14 at 12:00 am PST)
LIVEcommunity will temporarily operate in read-only mode as we prepare to welcome Idira!
Public content will remain accessible, but log-ins, posting and community interactions will be paused during this period. Thank you for your patience!
General Topics
Post a discussion here if you have general questions regarding configuration and troubleshooting for Palo Alto Networks products. Use this forum to collaborate with like-minded security professionals to improve your security posture.
About General Topics
Post a discussion here if you have general questions regarding configuration and troubleshooting for Palo Alto Networks products. Use this forum to collaborate with like-minded security professionals to improve your security posture.

Discussions

Start a conversation

Site to Site VPN | Remote traffic hidden behind remote peer

I'm almost done with a Cisco ASA to Palo Alto site to site VPN migration project. What I am having an issue with is once a tunnel is built, traffic from the remote side is coming out of the tunnel, hidden behind the remote peer, a typical hide-nat. For instance, Peer IP = 1.1.1.1ProxyID (remote) = 1.1.1.1 How do I get this to work in PanOS? It w...

Internal Host Detection in GlobalProtect

I am confused with GlobalProtect offical documents.From GlobalProtect troubleshooting guide:Internal Host DetectionInternal Host Detection provides hints to GP client to determine quickly if the PC is inside or outside office. If it is not configured, GP client will always try to connect to each internal gateway first. If it fails to connect to ...

linusso by • L1 Bithead
  • 35121 Views
  • 4 replies
  • 0 Likes

PBF Dual ISP, inbound NAT broke with spoofing protection enabled

Having an issue where we implemented PBF for dual ISPs on an HA pair that already had inbound NATs configured. When we did this the inbound NATs broke and I found this article:https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClzeCAC which basically said to remove the interface from the PBF specific route which I did but...

drewdown by • L4 Transporter
  • 6753 Views
  • 6 replies
  • 0 Likes

Userid timeout - renew action

How can a user trigger/renew UserID? Is there some action a user can take on the PC that would trigger UserID renewal. Rebooting is one way and has resolved this couple of times I was reported this issue. I think logoff and Log on should also work. Or installing globalprotect agent, which we don't want to on every system. So I am looking for som...

raji_toor by • L4 Transporter
  • 2182 Views
  • 1 replies
  • 0 Likes

HA4 Clustering to present a single NAT IP across two Data Centres

Can anyone who is using the HA4 cluster in production, to present the same external NAT IP across 2 data centers give any advice on how they are doing the routing. I saw in the docs that some of the security functions don't work if the traffic is asymmetric. Obviously the easy answer is to push all the traffic to one DC. Is that how people do...

Rich.H by • L2 Linker
  • 4696 Views
  • 3 replies
  • 0 Likes

Connect to globalprotect vpn using verizon mifi

Can you use a verizon mifi to connect to a globalprotect vpn tunnel? This is so they don't have to install the gp client on their pc. We do not have licensing for gp to be used on phones and to me a mifi is kind of a glorified phone.

jdprovine by • L4 Transporter
  • 5747 Views
  • 4 replies
  • 0 Likes

GP 5.2.5 Error authentication check failed

Hi Team, We have GP 5.2.5 on PAN OS 9.1.7Connection method is pre logon then on demand.on GP Gui logs i see error Error authentication check failed for ( eventid eq gateway-hip-check ) Even though we do not have hip check enabled on the GP.Is this error by design?how can i get rid of this error from gui logs?any config i need to modify?

Resolved! log at session end?

I have around 500 policies having 'log at session end' enabled and 'log at session start' disabled. I know Palo recommends logging at session end only but I also have a concern that for eg. a malicious file export that lasts for 8 hours and 10gigs go unnoticed if the session wasn't logged at the start. I am in a dilemma to enable the logging at ...

Resolved! IPv6 dual stack configurations.

Hello, I want to achieve IPv6 dual stack configuration on PA-850. What are the requirements for this type of configuration? For IPv4 traffic will hit to our IPv4 configured wan IP and for IPv6 traffic will hit to IPv6 configured wan IP. Please enlighten me how can I achieve my requirements. @SutareMayur @JoergSchuetter @kiwi @BPry @Brandon_Wer...

Url filtering

When user asks for providing full access what categories needed to b allowed & Blocked in URL filtering ?

KashifSh by • L1 Bithead
  • 4832 Views
  • 4 replies
  • 0 Likes

DP 100%

Hi Team, We came across a situation that our DP had just gone high at a time point till 100%. I checked with the system files and found some crashes have attached the screenshot for your reference. Also all the software status where running which i checked later after the incident.also find the output of show running resource monitor. This was t...

  • 24479 Posts
  • 125 Subscriptions
Top Solution Authors
View All
Labels
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks