How to best share user-id's or ip/User-mapping between different vsys. I want share user to IP-mapping for users connecting through global protect in separate vsys. But i think usecase can be extended to non GP mappings too.
Hi ,We have a customer running a cluster of PA 3060 . The goal is to enable security features on at least 30-40 percent of the rules initially . likeURL Filtering AntiVirusAntispywareWildfireVulnerability Assessment Are there any Best practices rules which covers or are generic to most ( if not all) organisations ? SSL Decryption is at later st...
Hi everyone!We have an HA A/A deploy, management vía Panorama.Have i any Variable to use for NAT's like Device-ID? to perform macro configurations? Regards
Hello everyone,I'm working with the Proofpoint EThreat,I'm trying to filter the output feed based on ET category.to archieve this, i'm editing the Output Node stlib with this condition:- actions:- acceptconditions:- confidence > 75- share_level == 'red'- proofpoint_etintelligence_categories == 'VPN'name: category CnC But it doesn't work, prob...
Good day. Is there any way to generate user logout events from syslog messages?Firewall is receiving syslog messages with client disassociate events from WLC.Tried a syslog Parse Profile with Event String as " Client Disassociated: ", still no luck. Thank you,
Hi guys, I am setting up agentless user-id with Windows Server 2003 Active Directory. My PAN-OS version is 8.1.16. For the setup, i've followed the guide here:https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGGCA0 Currently i am being hit by this error message:When I looked up for NT error code 0xc002001b, it shows tha...
Hi, I am using tac_plus linux server . user = larry { login = PAM member = admin } The above will support ? .As I know tacacs using pap or chap . In that case If can I use login = file /etc /password Or PAM in the server side configuration Thanks
Hi, We are using SSL Decryption and I only allow SSL traffic for specific URL's and categories which are excluded from SSL Decryption.Palo Alto has it's predefined list with SSL Decryption Exclusions (Device > Certificate Management > SSL Decryption Exclusion). From time to time I go to a website and it is blocked because:- It is predefine...
For an example, I have 2 security policies ruleA) source ip: any, source zone: any, destination ip: any, destination zone: any, application: dns, service: any, action allowruleB) source ip: any, source zone: any, destination ip: any, destination zone: any, application: any, service: any, action allow and traffic initiate from client is DNS reque...
I am trying to route traffic out our new PA-820. Internet Access seems to be working as designed with URL filtering applied for our End Users. The issue is with our Webex Video Units ( Room Kit Plus) that register to the Webex Cloud. Once I redirect the traffic from our Cisco ASA to the Palo Alto the Device, Video Endpoints will not register wi...
Hi, I added HPE iLO 5 as a new GP Clientless VPN Application, but it is not working. It seems it calls java, but based on PAN documentation it is supported javascript on Clientless VPN. There is any special thing to do for the javascript part? As you can see the page launches, so Security policies are allowed, but stays here stuck: Has anybo...
Hey, Is there anyone knows how can I get steam saves to cloud?Let me know, if someone knows regarding this.
Hello , We have currently three diffent zones defined . Zone A vlan 100. For wired users Zone B vlan 200 for wireless users Zone V tunnel/ loopback interface for Global protect users. All the above users mentioned are corp users. Now customer wants to create. single zone called "All users" and want to put vlan 100 200 and loopback/ tunnel into i...
So we are trying to prevent the Palo Alto agent from opening at startup. I believe I fixed that initially by removing its entry from"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run".However there's a service running, "PANGps" ("C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe") that appears to continue re-lauching the process "C:\...
We have two on-prem data centers connected with dual L3 EVC links between them on our core switches and we are using OSPF for routing. We also have PA firewalls deployed in each location and we are extending OSPF up to them. We are then connected to Azure over each of the PAs over an IPSEC VPN and using BGP and injecting the OSPF routes. If I di...
PavelK
on:
Throttling ingress bandwidth on a sub-interface
BPry
on:
Github EDLs missing IPs?
PavelK
on:
Does the firewall need to have Panorama IPs in its permitted IP list for MGMT interface?
OtakarKlier
on:
Palo Alto 1420 - Invalid username or password.
