General Topics

Authentication server option

I have a new Palo Alto 820 and my Radius server is a Juniper running 9.1 . At this time my Cisco and other device use a share key to Authenticate to the Juniper device. On the Palo 820 Pan os 9.1.4 it want me to use the following Auth methods "PEAP-MSCHAPv2, PEAP with GTC, EAP-TTLS with PAP, CHAP, PAP" which I do not use. I want to know how I...

Address-Group Objects

Hi, Does anyone know if there is a limit to the number of address-objects in an address-group-object?

Thinking about moving from SonicWall NGFW to Palo Alto

My company has been using SonicWall for the last 7 years or so, and we're currently on a NSA 3600 (NGFW) HA pair for main branch and a TZ500 for a small remote office. The TZ500 is totally fine and the 3600 works ok for the most part but there are always a lot of bugs and issues seemingly for every service and feature (espeically HA). Changes an...

Resolved! SSL decryption issue for Windows Store

Hello, After enabling SSL Decryption, we cannot download from Windows store. Getting error below.Tried excluding hostname with Microsoft but no luck. How to fix this issue? Thanks in advance.

Resolved! Using the Panaroma as a central manager for Cisco AnyConnect.

Team,Any one aware if we can even use the Panaroma a a central manager for the Cisco AnyConnect firewall?My use cases are: 1. Central management and to push policies to the Cisco AnyConnect. 2. Ensure policies are in sync and same across all AnyConnect nodes.3. Possible backup of the Cisco AnyConnect configuration.4. Possible historic logs stori...

FW has stopped recognizing several users and does not map them with the corresponding domain group, so it does not apply the necessary policies.

Hello,We have changed a 2 palo alto 5220 in cluster for another 2 palo alto 5250 version 8.1.16.We have migrated the configuration by exporting and adapting the xml.Everything works ok except for a detail in the new passive fw. we have detected it when switching and testing.The fw has stopped recognizing several users and does not map them with ...

PXE boot not working through FW

Hi all,I have a FW with PanOS 9.1.7 that is causing PXE boot issues with TFTP protocol.When traffic is not routed through the firewall it all works and I have seen several threads about this problem but no solution. DHCP server: Windows Server 2012 R2 172.18.76.23WDS server: 172.18.76.20 DHCP option 66: 172.18.76.20DHCP option 67: \boot\x64\wdsn...

Resolved! Azure HA not coming up

Do I need license to test Azure HA scenario. I am following all the steps but HA1 doesn't come up.I don't have any licenses. And doing a test run of implementation as HA active/passive.Default 10.0 gets installed with BYOL, but we don't have license yet.

Resolved! Finally have pre-login working - but now

I'm excited to finally have pre-login working per the logs below. But after the successful certificate based pre-login, portal-getconfig fails. On the pan the error message is "Failed to get client configuration". Any advise on how to troubleshoot this further is appreciated!

SSL Decryption Issues - MacOS Big Sur 11.2.3

We have had SSL decryption configured since we deployed Palo Alto firewalls and it works with little issue on our Windows OS platforms. We have a new project to deploy a few MacOS clients as the application development team requires the ability to test Safari browsing of some web apps. Our internal Root CA has been imported into the keychain an...

How long time will need to prepar the PCNSA

Hi everyone I would like to prepare the certification PCNSA.My idea is to pay the tax exam as soon as posible will make force me to study the exam. I would like to know how many hours and time will need for I am going to the exam. Regards

Resolved! 2 ISP NAT question

Hello, we have 2 ISPs . .Static route with metric 10 for the 1st one and another static route with metric 20 for the second one .We have 2 nat rules for LAN. 1st one is via ISP1 and 2nd is via ISP2.So when we change the default route we need to reorder the NAT policies in order to have internet.Is there a option to change default routes without...

PA Destination NAT

I have a use-case that all subnets/VLANs should be able to access the server (192.168.4.4) via HTTP using the loopback IP address 192.168.6.2/32. The PA firewall is the gateway for all the VLANs. I would like to confirm if this is possible? The source will be VLAN 5 or VLAN 10 and destination is VLAN 20's loopback IP 192.168.6.2/32 using HTTP se...

Resolved! Aplicação incompleta

Galera, boa tarde. Estou com um problema bastante confuso, tento acessar um determinado site "HTTP" é recebo a erro (Não é possível acessar esse site), realizamos um teste fora da nossa rede é o acesso é realizado normalmente. Analisando os LOGS verifiquei que recebemos a ação incomplete.O que estamos fazendo de errado ?

application

Guys, good afternoon. I have a very confusing problem, I try to access a certain "HTTP" site and I get an error (It is not possible to access that site), we perform a test outside our network and the access is done normally. Analyzing the LOGS, I found that we received the incomplete action.