This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
General Topics
Post a discussion here if you have general questions regarding configuration and troubleshooting for Palo Alto Networks products. Use this forum to collaborate with like-minded security professionals to improve your security posture.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
General Topics
Post a discussion here if you have general questions regarding configuration and troubleshooting for Palo Alto Networks products. Use this forum to collaborate with like-minded security professionals to improve your security posture.
About General Topics
Post a discussion here if you have general questions regarding configuration and troubleshooting for Palo Alto Networks products. Use this forum to collaborate with like-minded security professionals to improve your security posture.

Discussions

Start a conversation

Resolved! Our custom-app has impacted all SSL traffic

Hi Team, We have a client who do not have SSL decryption and has many third-party applications working over SSL on different ports other than 443. The client has a security requirement that all applications need to be categorized by Palo alto firewall, so they do not wish to use any service ports in the Service column field. Also, they do not w...

bambox by • L1 Bithead
  • 4075 Views
  • 2 replies
  • 0 Likes

userID agent not connecting

5220(9.0.11) firewall connectes normally to local DC running userid agent, but I see this for a remote DC which also has the agent installed. The same remote DC is connected successfully to 850(9.0.11) firewall on remote site. Not sure what the issue is here. 03-10 07:24:16.210 -0800 Error: pan_ssl_conn_open(pan_ssl_utils.c:843): Error: Failed...

raji_toor by • L4 Transporter
  • 3189 Views
  • 1 replies
  • 0 Likes

Config Audit

Hi Everyone - I wanted to pose this question to the folks out there that may be feeling the same as I do about the way the config audit feature works. It is supposed to be a simple way to do a diff on config changes/deletes. I have found that palo seems to insert simicolons and braces throwing off the reporting and making it less than optimal fo...

combine more than two port for internet connections

Hi I wish to understand how combining more than two ports for internet connections works. I have configure four ports for internet connections with deferent speed. when I perform a seed test. I think, some result base one companying all port seed - fast speed result- but some times base on one port speed - slow speed result . so I am not sure ...

ehsunn by • L0 Member
  • 4325 Views
  • 3 replies
  • 0 Likes

MineMeld - Memory Leak or Redis needing configured?

Build: Followed the Azure 16.04 LTM instructions Problem: Every 3-4 days after increasing to 4 CPU's and 16 GB Memory the memory seems to creep up to the point of borking the instance. WorkAround: Every 3 days restart the engine. Context: Currently have 1 source producing over 800K over time steady after aging out happens. 8 Miners 3 Procs...

Romans6 by • L1 Bithead
  • 4076 Views
  • 2 replies
  • 0 Likes

Resolved! Adding a 2nd ISP

I have been reading up and still trying to wrap my head around the exact setup I need. Current ISP1 - use for all LAN traffic out including IP phones. Use global protect also. Have external DNS setup so remote.mydomain.com goes to this ip address. Still want this ISP used for all traffic unless it goes down ISP 2 - I have one backup server that ...

Resolved! Active Active HA3 Through EVPN/VXLAN

Have an Active/Active deployment, single firewall at each DC with EVPN/VXLAN through Juniper cores. Can we have the HA-3 link go through the core switches? We are using daa plane interfaces for HA-2, HA-2B, and HA-3. We have the vlans stretched across to the other data center for the HA-2 and HA-3 links and jumbo frames enabled. I need to verif...

Resolved! L3 ARP entries

Hello Mr. We need to make some mac address in Palo Alto L3 interface.the question is that , How many manual arp entries can be added per single interface?and because no document discussing it, I wanted to make sure if this works as an ARP inpection, so IP and MAC address must mach, or the packet will be dropped.Kindly answer and confi...

Shadow Rule Warning after upgrade

Hi All, We have a customer who has upgraded to 9.0 and they get shadow rule warnings since the upgrade. All the shadowing rules are more generic with any/any for source and destination, but with source user restrictions.The shadowed rules have more specific source/destination values. Traffic is hitting the shadowed rules. The same rules weren't...

Saml IDP certificate.

Hi Team, We need to integrate Saml With Global Protect .We have done the saml configuration in azure perfectly fine.We have exported the metadata file from azure and inported in PA NGFW successfully.We need to achieve through IDP certifcate but the issue is we are unable to add the IDP certificate in authentication profile in certificate for sig...

Global protect client stuck on connecting

Hi All - Global protect client for a few users is stuck on connecting state, is anyone able to help me look into P 865-T24627 Mar 05 07:15:48:180208 Info ( 495): Server is trusted ***.gpcloudservice.com(0.0.0.0)P 865-T19203 Mar 05 07:15:48:445236 Info ( 389): Finished with ****.gpcloudservice.com:443P 865-T19203 Mar 05 07:15:48:445253 Debug( 309...

WildFire Analysis Exclusions? smbv3

Seeing a lot of false positives with WildFire for application ms-ds-smbv3, specifically for PE+MSDOCX files. Is there anyway to just exclude ONLY this application from our Wildfire? I'd really hate to have to create a 2nd WildFire Security Profile and another Policy Rule just to exclude 1 application type. If we do have to create a 2nd WildFire ...

pan_rags.png
Rags by • L2 Linker
  • 2492 Views
  • 1 replies
  • 0 Likes

Resolved! Is there a way to limit the number of response or captive portal pages, generated by the L3svc process for 1 second?

Hello to ALL, I have seen several cases where data plane overutilization may cause the managment plane to crash. In most cases I see the Devsrvr process to commit many times and to restart the L3svc process that uses I think it uses something like nginx as the palo alto firewall logs seem to be nginx related but it could be something else (that...

  • 24413 Posts
  • 125 Subscriptions
Top Solution Authors
View All
Labels
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks