Hello Guys, One of my client is received the logs of data filtering with license-expired category. How to troubleshoot this issue?
One user of our company has an issue connection to the GlobalProtect Gateway using IPSEC, but there is also no fallback to SSL.His ISP carrier is using "Carrier Grade NAT" and this is likely the cause of his issue. I know that we can force SSL connections on the Gateway, but this is a global setting and will be affecting all users, I just want t...
I want to check all my object addresses with zero traffic to clean up my flow rules. Can I replace my sources and destination IP with an "all IP" setting ? Can you help me ?section "Query Builder" does not work (see image)
Hello, For testing purpose, I added VR and Zone to Eth Interface1/3. I have removed everything from it but in the Dashboard it shows Red color. This creates confusion as some think the interface is down even though nothing is connected to it. Is there anyway to turn it back to gray?
Multiple questions - Recently we've found that traffic not within a URL category specified in a rule is being allowed. The rule appears to be allowing the traffic as the session starts and ends with the action of allowed determined. Would using the same category within a URL filter differ than only having a category configured? It's my understan...
We have outbound decryption working but there are few sites that popup that donot work from time to time and have to add the to exceptions. I am trying to investigate a recently highlighted website and to learn how to troubleshoot this better. If I run this openssl command connection on the client is successful and wireshark output looks like th...
Is there a way to limit /throttle qos per device? Outside of making a QOS rule per subnet or ip host? I know on some platforms there is a way you can limit every client to a max of 500kb/s per device. Is there any easy way to do this with the firewalls? I do see the below link, but that is more related to the entire subnet vs. per host lim...
Hi All, We are planning to migrate from PA-500 to PA-220, and there are some concerns to verify. Here are our current versions. My concerns are, 1) How we can match the OS/Content versions with the new PA-220?2) What will be the migration procedure from PA-500 to PA-220?
Hello Experts, I am new to PA and trying to understand how below can be achieved. I am trying to set up IPSec tunnel between checkpoint and PA.Diag: I want to establish a IPSec tunnel between CP and PA. On PA side i have 172.16.0.0/24(inside zone) private IP range which i want to NAT to 10.172.0.0/24 and send it to CP side as intresting traffic....
Hello,We have a Palo Alto running v9.0.9-h1 with an outbound to Internet rule which as follows: From: Internal NetworksTo: Internet ExternalApplication: ssl What we are trying to achieve is for the firewall to ensure that only SSL/TLS traffic is allowed outbound. The issue is that that the firewall categorises well-known services such as Salesfo...
Hi everyone, I'm trying to setup a route based IPSEC tunnel between my PAN 3020 and Cisco 2900 router. I'm getting a parameter mismatch on on the ipsec lifesize parameter and don't know how to fix it. The Cisco peer appears to be wanting a lifesize setting of 4608000KB but the PAN won't let you set it that high. I've tried setting it with the ...
Hello team, I have cluster active-pasive PA-820 version 10.1.0 When I make a commit I recibe this alert " Warning: No Valid DNS Security License" Someone helps me? Regards
Hello allI am new in Palo Alto devices and PanOS, so here is my questions.Is there a way to select an active directory OU as a source user in a security policy?(Or something else to manage it)Working with Forcepoint they apply policies to a whole OU (and also users and groups) Thanks in advanced
I am running 9.1.10 on the PA-850. Last night, I replaced the User-Agent Server and pointed the PA-850 to the new UA server. After that, the CPU on the management goes up to 100% and stayed there until I had to reboot the PA-850. I attempted to restart the management server process but that didn't fix it either. After reboot, the CPU on the ...
Hi Team, Today i came up with an issue that i am not able to access JIO Meet application. While i was checking the applipedia website the JIO app was not there.I came up with a solution to create a custom application. Yet not sure which ports are used. Is it possible to share the details so that i can create a custom application with it. ThanksV...
PavelK
on:
How to build SCM Managed NGFW with no management internet access
MP18
on:
the Maintenance support for Palo Alto Networks hardware components
MP18
on:
How to block all AI-based applications
reaper
on:
Server monitering -Connection refused
PavelK
on:
Commit Failed
