This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
General Topics
Post a discussion here if you have general questions regarding configuration and troubleshooting for Palo Alto Networks products. Use this forum to collaborate with like-minded security professionals to improve your security posture.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
General Topics
Post a discussion here if you have general questions regarding configuration and troubleshooting for Palo Alto Networks products. Use this forum to collaborate with like-minded security professionals to improve your security posture.
About General Topics
Post a discussion here if you have general questions regarding configuration and troubleshooting for Palo Alto Networks products. Use this forum to collaborate with like-minded security professionals to improve your security posture.

Discussions

Start a conversation

BGP filter route only for /32 prefix

Hi Experts, My question is, my Cisco switches advertise host routes to FW from many VLANs/VRFs together with other network routes, we want the firewall Not to accept the any routes with subnet mask /32 but accept anything else, can you help to see if the firewall can do this kind of route mapping? Which can be easily achieved in Cisco router by ...

rahul.k by • L0 Member
  • 5398 Views
  • 1 replies
  • 0 Likes

Agentless User-ID agent permissions

We are attempting to use the agentless User-ID setup with the understanding that the service account needed to be a member of the following AD groups: Distributed COM Users, Event Log Readers, and Server Operators. However, after reading the following Palo Alto documentation on how to create the service account it seems that there is some confli...

Dynamic Address Group with Azure monitoring

https://docs.paloaltonetworks.com/vm-series/9-1/vm-series-deployment/set-up-the-vm-series-firewall-on-azure/vm-monitoring-on-azure/set-up-vm-monitoring-on-azure.html In the end article tells to create DAG but how do I add VM's automatically to this group. Is there a wildcard that i can use like 'azure.vm-name.*'. I tried but its not working. Al...

raji_toor by • L4 Transporter
  • 5426 Views
  • 2 replies
  • 0 Likes

System log message Clearing snmpd.log due to log overflow

I am wondering why I see the log 'Clearing snmpd.log due to log overflow' on several of my firewalls. Out of the ~20 firewalls I manage 2 or 3 firewalls log this message on occasion. The other firewalls never log this message. I am trying to understand why this occurs on just a few firewalls. Should I be concerned about the message? What do I lo...

SNMP and Netflow

PAN 9.1.8 has SNMP V3 configured base onhttps://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClHOCA0with Netflow on AE5.30, ae5.50, and ae5.60 of the 5260 base on https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/monitoring/netflow-monitoring/configure-netflow-exports.html#id4ad7a523-e577-41ab-8b77-4034458a2a7b On m...

arhong by • L1 Bithead
  • 4695 Views
  • 5 replies
  • 0 Likes

Content filtering for MAC OSx

I am trying to finalize my content filtering for our PA 820 rollout. I have the user-ID, group mapping and content filtering rules (By group) working just fine for my windows PC's. Where I am stuck is trying to figure it out for all of our MAC OSx users. None of our MAC's are joined to our domain and I am not sure about adding them at this time....

RussMc by • L1 Bithead
  • 3180 Views
  • 2 replies
  • 0 Likes

Resolved! PA Packet Capture Data Storage Location (CLI)

I’m trying to figure out how to view the data location of an in progress packet capture in the CLI. I’m aware of the current packet size in the GUI, but I would like to see where the data is logged in the CLI along with the current available storage remaining.

IsaiahF by • L1 Bithead
  • 4411 Views
  • 2 replies
  • 0 Likes

OSPF stopped gracefully restarted

Hi Team, We are facing issue with OSPF is not working properly over the firewall as per the configuration part seems fine we checked with the below given document.https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm5ZCAS All the configuration for HA is configured as per above given document.We checked with the configurati...

OSPF issue.jpg

Log redistribution after adding additional log disk.

Recently we added a 2TB log disk to this virtual Panorama running 8.1.19 on VMWare ESXi 6.5 Once adding, the log redistribution process on the local log collector started as has been progressing very slowly. Over the course of 15 hours this job progressed to 7% >show log-collector all...... Redistribution status: pending --- 7% How long...

can we forward logs to two different logs collectors from same fiirewall?

We want to store log copy on two collectors for redundancy.Note : We don't want to go with collector group(with both collectors in same group) config with redundancy, as this config half the space.Example. Panorama M200 is in HA with above config , we get search engine quota in single panorama is 7.5 TB.Search Engine Quota Stats: Total Disk(s) S...

Deepak25 by • L3 Networker
  • 2612 Views
  • 2 replies
  • 0 Likes

User is trying to connect with MS-RDP. Log shows TCP 3389 but application is not-applicable

We've got a remote user connecting with GlobalProtect. He's trying to RDP to a PC on our inside network. There is a security policy that he should be matching- traffic matches source and destination zones, user-ID is matching the right group, HIP check is good. it seems to be failing to match the policy because it's not matching on the appl...

Resolved! Global Protect MFA Vendor Support

I am a bit confused with the MFA vendor supported by the firewall, because the Compatibility Matrix says that MFA server profile is not supported for Global Protect?https://docs.paloaltonetworks.com/compatibility-matrix/mfa-vendor-support/mfa-vendor-support-table.html# I am aware that any MFA vendor can be configure over Radius Server, but pre...

BatD by • L4 Transporter
  • 10740 Views
  • 6 replies
  • 0 Likes

Is there CLI - Enable and Commit Policy

Dear all, Since my WebUI is not responding even with a system reboot and management restart by CLI, SSH works fine, Is there a way by CLI to enable and commit Policy? Any help would be greatful. Thanks, Sean

Resolved! RADIUS And Open LDAP Integration.

Hi team, I have come through as a requirement from one of my clients, They are using RADIUS Server for RSA authentication for globalprotect, but in USER ID they are using OpenLDAP, So in the ip-user-mapping, Whenever user connecting to globalprotect, I can see the user detecting from the GP and the only as "username", but the customer has config...

  • 24428 Posts
  • 125 Subscriptions
Top Solution Authors
View All
Labels
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks