General Topics

Fuel Workshop - Watch Now: Managing Your Palo Alto Networks Assets and User Accounts

In case you missed it, check out this new Fuel Workshop series, which covers the following topics:

Customer Support Portal Overview
License Management
RMA Best Practices

Dive into the three-part Fuel Workshop video series and learn how to efficient

...

Ensuring a Safe and Secure Community: How You Can Help

Dear LIVEcommunity Members,

Ensuring a top-tier experience on LIVEcommunity and protecting our members’ safety and security is our top priority! To this end, we have implemented additional security measures to safeguard our vibrant global commun

...

Introducing the LIVEcommunity Support FAQ: Your Valuable Customer Resource

LIVEcommunity is thrilled to introduce its new Support FAQ section, designed to help Palo Alto Networks customers quickly resolve their common queries.

You'll find this new area under the Articles section of the main menu:

Our goal is simple:

...

Resolved! What is the best way to import a device state to an old device

Recently we faced an issue with one of the firewalls so we thought to replace with a spare one. we took the device state backup and imported it into the Spared firewall. It was running the same OS and same hardware. But It was NOT factory reset, it h

...

How do I remove diffie-hellman-group1-sha1 from SSH on mgmt port? And how to push it via Panorama?

Hi,

How do I remove diffie-hellman-group1-sha1 from SSH on mgmt port? I've removed the CBC ciphers, but my vulnerability scanner is still showing that diffie-hellman-group1-sha1 is still available for SSH.

I'd also like to know how I enforce SSH serve

...

User ID v. UPN

We are moving to Office 365 and standardizing on UPN for identification. This required that we create a new UPN suffix for our AD domain. We decided to have our UPN match our email address format. Below are samples of each attribute format:

FQDN

...

Resolved! Palo Alto 7000 heartbeat backup icmp fail

Hello to All,

From time to time the ICMP fails for the management connection between two firewalls model 7000 with 8.1.x version. The issue causes a failover but the 7000 firewalls have dedicated interfaces for HA and the management should be used o

...

new Validation Check feature introduced in PAN-OS 8.1

Hello,

We use centreon as monitoring tool and I get the next alert from palo alto devices

PALO ALTO NETWORKS CONTENT VALIDATION CHECK SKIPPED BY USER 'CENTREON USER' FOR [CONTENT VERSION]"

I found the next documentation about this

https://knowledgebase

...

Resolved! M200 raid disk pair status stucked at 0%

To enable the disk A ,we have run the below command

request system raid add A1
and after 5 min run below command :
request system raid add A2

But disk is not enabled. Status is stuck at 0% since last 6 hours.

How we can resolve this issue ?

Resolved! GlobalProtect clients experiencing latency delays

Hello,

Clients who are connected via GlobalProtect VPN are experiencing slowness with all their traffic traversing the VPN (ie.. Internet and Server access traffic).

The latency is between 200-400ms for all the traffic regardless of whether its Intern

...

Resolved! GlobalProtect Gateway: can it share an IP used in NAT/Security Policies?

I have a working GlobalProtect setup right now using a single Portal on the district firewall, and a single Gateway on the firewall for the location I want to have access to.

Currently, these are using dedicated public IPs that are not used for anyth

...

AE Interface down during failover

We recently had a failover event during a normal upgrade of the firewall (10.0.1 -> 10.0.4). The LACP aggregate interface on the Cisco switch / Firewall did not come up during this time, which resulted in a longer than expected outage. Powered down f

...

Service route in panorama.

Dear Team,

I have two interfaces configured in my panorama:

1-management interface

2 -ethernet1/1.

for software and dynamic updates by default, my traffic is going via management interface. I want to change the service route through ethernet1/1 but I a

...

Resolved! Study tip for PCNSA.

Hello everyone,

I spent a year working directly with Palo Alto firewall and I would like to get some certifications, but all video content I find is purely in English and I still don't have a command of the language.

Did they have any text material t

...

Resolved! Policy Based Forwarding

Hi All,

I have a guest wifi vlan 10.25.x.x that needs to be routed out to a second ISP.

AP-->WLC--Palo Alto FW-->MPLS/VPLS-Router-->L3Switch-->ISP

The vlan will each have a sub-interface and gateway 10.25.x.1 assigned on firewall in its own guest

...

PA-7050 policy does not show anything in rule usage column "Apps Seen"

I noticed that all our PA-7050 PAs don't show anything in rule usage "Apps Seen" column for rules that are supposed to see many apps. It is not a problem on other models. Any idea?

OKTA SAML panorama authentication?

Trying to get this working and I am able to authenticate using OKTA SAML via the button on the login screen but when I do (after entering u/p on the OKTA page) it redirects me back to the Panorama login page. I see PAN_AUTH_SCUESS SAML on the CLI b

...

Resolved! 1:1 destination nat mapping

Hi everybody,

does anybody know if it is possible to write a single destination NAT policy in order to map ip addresses from a given range/network to a corresponding range/network of the same size preserving the host portion of the address? I try t

...

Discussions