This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
General Topics
Post a discussion here if you have general questions regarding configuration and troubleshooting for Palo Alto Networks products. Use this forum to collaborate with like-minded security professionals to improve your security posture.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
General Topics
Post a discussion here if you have general questions regarding configuration and troubleshooting for Palo Alto Networks products. Use this forum to collaborate with like-minded security professionals to improve your security posture.
About General Topics
Post a discussion here if you have general questions regarding configuration and troubleshooting for Palo Alto Networks products. Use this forum to collaborate with like-minded security professionals to improve your security posture.

Discussions

Start a conversation

Bi-Directional NAT To External IP not Configured on an Interface

Hey All,Working on a PA-220 on 10.0.6 here. I am trying to configure a BI-DI NAT for inside Zone A host 10.0.0.4 to Zone B public IP: 5.183.105.227. This traffic is to allow a vendor to build an IPSec VPN tunnel between their VPN appliance configured as 10.0.0.4 to their remote peer VPN of 99.169.208.245. Zone A = Inside (Interface 1/6: 10.0.0.1...

Traffic block due to EDL

I have found traffic blocked due to edl inbound policy. Traffic is blocked for random time like hour or one and half hours for random port.after some time traffic is moving. Another thing is traffic is moving for one destination ip and this destination ip is not in that edl list, but traffic blocked and move in random time for this destination. ...

SurajN by • L2 Linker
  • 2451 Views
  • 1 replies
  • 0 Likes

PA 410 reboot time

Anyone know the reboot time on a PA 410? Looking to see if its better than the PA 220. Thank you,Ted

treese by • L3 Networker
  • 3570 Views
  • 2 replies
  • 0 Likes

Resolved! Required permissions for Active Directory integration

Hello, I am trying to get AD authentication to work for GlobalProtect. I have been following this document https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CmAdCAK for configuring the AD integration part, and it says: Before you integrate a Palo Alto Networks device with AD, you must create a user ID in AD that you'll u...

client certificate authentication fails even though machine has certificate.

One of my setup with client certificate authentication in gateway was working fine. For some reason, it gives me 'Required client certificate not found. Please contact your IT administrator' error. The certificate is available in the client machine certificate store and PanGPS.log shows it is able to identify the same. But After which it fails a...

Resolved! Is there a better way to block non-default app ports?

After parsing some logging I've discovered some trends in users utilizing non-standard ports for some App IDs and I want to prevent that. The first thing that comes to mind if to create a policy only allowing the app-default port, but the issue is currently this traffic is hitting a more general permit rule at the bottom of the policy stack. We ...

Rules that allow bittorrent

Guys,I need to figure out the rules that specifically allow BitTorrent traffic in Panorama.Method that I use is searching traffic logs with (app eq bittorrent) and (action eq allow) and exporting .csv and sorting the rules. Is there any other quick method that anyone use? Thanks

Dhawala by • L0 Member
  • 2949 Views
  • 2 replies
  • 0 Likes

tracking bursty traffic with the firewall

Dear community! I´m seeing in the interfaces the "rcv_fifo_overrun" counter increasing quite a lot and I´d like to find out what´s the root cause. Is there a reliable way to verify in the firewall if the reason of this counter to increase is some bursty traffic or anything else? Thank you!

Carracido by • L4 Transporter
  • 2832 Views
  • 2 replies
  • 0 Likes

Palo Alto Management Interface Inbound Discards

Starting in either PAN-OS 8.1.x or 9.0.x we have noticed that SNMP is reporting inbound discards on all of our Palo Alto management interfaces in our monitoring solutions. It seems to be be specific only to the management interface as other physical interfaces of the device are not reporting issues. Has anyone here experienced this? I'm looki...

GCP Miner

Has anyone found a list/feed for GCP that actually contains zone information? Has anyone created a miner with such feed?

JDomNY by • L1 Bithead
  • 2989 Views
  • 1 replies
  • 0 Likes

procedure to clear logs of M200 disk-pair

M200 is in HA with local log collector configured on both panorama and log redundancy enabled. We want to disable redundancy to gain additional space for logging. We want to clear logs of Secondary Panorama M200 disk-pairs and use it for logging from scratch. No procedure found in Panorama Admin guide.Please suggest best way to clear the stored ...

Deepak25 by • L3 Networker
  • 3765 Views
  • 3 replies
  • 0 Likes

Resolved! Does Global Protect VPN has Two-Factor Authentication - Looking at VM-100/300 virtual PA and Physical PA-820

Team, Customer is looking for Multi-Factor authentication for VPN client, currently they have GlobalProtect, but they need to enable MFA for remote users, does Palo Alto has any feature or solution to achieve this? Need to check if both VM-Series and Physical has built-in MFA for remote VPN users (Global Protect) VM-100/300 virtual PA and Physi...

Connecting 3rd-Party VPN Device to PA-3220

Hi. Wanted to ask for opinions, suggestions, and experience on this. We have a Cisco ASA VPN Device from our vendor and we'll need to connect this to our PA-3220 FW. So basically, Internet --> PA3220 ---> ASA VPN --> LAN. This ASA will be inside our network and NOT remote. I would like to know if there is a way to connect this and make ...

Mitel decrypt error

Hi all,we have a open ticket with TAC, but wanted to ask if anyone's seen this, we're in the testing phase of it, and one of the phone's traffic shows up in the logs as decrypt error in the end result, so that phone is not able to login to the mitel portal, tac also disabled the user-id policy to narrow it down(I have tried to add a app override...

cdcirexx by • L3 Networker
  • 7843 Views
  • 8 replies
  • 0 Likes
  • 24412 Posts
  • 125 Subscriptions
Top Solution Authors
View All
Labels
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks