This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
General Topics
Post a discussion here if you have general questions regarding configuration and troubleshooting for Palo Alto Networks products. Use this forum to collaborate with like-minded security professionals to improve your security posture.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
General Topics
Post a discussion here if you have general questions regarding configuration and troubleshooting for Palo Alto Networks products. Use this forum to collaborate with like-minded security professionals to improve your security posture.
About General Topics
Post a discussion here if you have general questions regarding configuration and troubleshooting for Palo Alto Networks products. Use this forum to collaborate with like-minded security professionals to improve your security posture.

Discussions

Start a conversation

How to onboard passive PA440 firewall to Panorama using dataplane interface

I need assistance integrating Palo Alto firewalls in an Active/Passive HA setup with Panorama. Below is an overview of the setup: At customer sites, we have Palo Alto firewalls configured in Active/Passive HA mode, and they are currently managed locally. We are now planning to integrate them with Panorama, which is hosted in the AWS cloud. An ...

Ramesh by • L0 Member
  • 1641 Views
  • 3 replies
  • 0 Likes

CONFIG logs and syslog

Hi there, we're shipping our logs to a centralized syslog instance. That works great for all types of logs from the PA with the exceptions of the CONFIG logs.The CONFIG logs are submitted at all, with the problem that the interesting parts "before-change-detail" and "after-change-detail" are not delivered.Does anyone else ship CONFIG logs and if...

Discover LIVEcommunity Through Our New Animated Explainer Video!

We’re thrilled to unveil a brand-new animated video that highlights everything LIVEcommunity has to offer! This short and engaging video gives you a quick tour of the many resources available in our vibrant community — from interactive discussions and customer journey guides to the Cyber Elite program and Member Spotlight features. Whether ...

kiwi_0-1745308399217.png
kiwi by • Community Team Member
  • 4543 Views
  • 0 replies
  • 0 Likes

Resolved! PublicCloud Server certificate validation failed

Hi community, I have an issue where system log shows severity high for an event: tls-X509-validation-failed and the description: Palo Alto PublicCloud Server certificate validation failed Dest Addr: sg.wildfire.paloaltonetworks.com Reason: unable to get local issuer certificate Palo Alto PublicCloud Server certificate validation faile...

Nesicito desistalar

Hola, trabajé con una empresa telefónica que me instaló el programa Cortex. Ahora que ya no trabajo con ellos, quiero desinstalarlo, pero no encuentro la forma y no puedo contactar a la empresa. El programa está afectando el funcionamiento de mi PC. ¿Hay alguna manera de desinstalarlo sin la contraseña? Necesito ayuda para solucionar este problema.

Paul.00 by • L0 Member
  • 664 Views
  • 1 replies
  • 0 Likes

Block YouTube in general, but allow videos from specific YouTube channels?

We have YouTube blocked in our organization and allow access for individuals to it (the entire service) based on business need and director approval via User-ID and membership in a specific AD group. Now one arm of our organization (that has access to YouTube, of course) has decided that it is a good idea to create a YouTube channel and has aske...

Backup Internet with Ipsec VPN doing BGP

Hello,Mostly just need a sanity check on this configuration.I am setting up a backup internet for one of our hub sites as a failover. Currently the connection to the other primary sites is via a IPsec tunnel using iBGP to pass routes between the "Hub" sites as well as redist into OSPF for internal traffic and routing to spokes.The External VR ha...

Result: Failed to validate server certificate for endpoint api.paloaltonetworks.com

issue1:I am having issues with getting Panorama and firewalls connected up to datalake. I opened a case and i am told it can't connect to api.paloaltonetworks.com. I have pcap that says otherwise. There is no ssl decryption in between. Its frustrating when you spend serious amount of money on this storage and it doesn't work.issue2:I am have a h...

Enable global setting preserve-prenat-feature for prenat user-id

Hi. I have GP and userid configured at Pan OS 11.1. I'm getting the message. Warnings: . vsys1 . Warning: please enable global setting preserve-prenat-feature for prenat user-id to be effective. I can not find anywhere in menu the mentioned global setting. What else should be done for the correct configuration?

userid.JPG

Ha2 is going down every 5 6 days .. .my palo version is 10.2.9.h11

I am facing this issue in my current palo alto where my palo alto firewall keep on flapping after evry 5 6 days like suddenly seconday device is getting active and after sometimes it is coming back to normal not always it is coming to normal sometime we have to reboot the primary firewall, when checked thew system logs and ( description cont...

Resolved! How to add/delete host keys

Hello,I was testing out different SCP servers to export logs from the PA firewall, but I got this message after my third SCP server:<user>@PA2050> scp export logdb to <user>@10.200.168.158:logdb@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @@@@@@@@@@@@@@@@@@@@@...

sonet by • L2 Linker
  • 13249 Views
  • 2 replies
  • 0 Likes

Resolved! IKEV2 w Cert - Wildcard peer for DN does not work.

Can someone please give me the format you are using for the peer id using DN with a wildcard. CN= ?? I try CN=* CN=lab-fw-vyos-* The DN in the logs coming in from the peer is lab-fw-vyos-testsite when I try CN=lab-fw-vyos-testsite it works but I want to terminate all peers on this IKE gateway so I need a wildcard. Any ideas? Thanks, Nathan

NSutfin by • L2 Linker
  • 2028 Views
  • 4 replies
  • 0 Likes
  • 24410 Posts
  • 125 Subscriptions
Top Solution Authors
View All
Labels
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks