General Topics

Social Media not blocked

We had created a security policy to block all social media and it was working fine, then since two weeks we found that Social Media is working and when i check the security policy everything shows fine and I checked the logs it shows as deny but even then Youtube Facebook is working fine. Regards, Mohammed Ibrahim Ahmed.

Resolved! how to generate an AWS Redis Auth code ?

I need the following in the bootstrap redis-auth=<redis-auth-code>how to generate this code ? thanks !!

Resolved! How to validate Redis connection from vm-series on AWS ?

like to know how to validate Redis connection from vm-series on AWS ?Anyway for me to check Redis status on AWS vm-series firewalls ? thanks !!

WI-FI calling through paloalto

Hello Team, I am trying to allow the wifi calling in my network because of coverage issue from the provider. now its blocked in my internet and network. how to make sure the wi-fi calling is allowed through paloalto firewall. panos 11.1.4-h3 TIA

Migration from Juniper to PANOS

Hi All, we are looking at migrating from juniper to PANOS, now that expedition is EOL, what's the process for this please.Any insight would be great. TYIA

BGP Session Establishment Troubleshooting on Palo Alto?

Hi Folks....requesting anyone's Palo Alto FW troubleshooting expertise: In one of our implementations, we ran into some BGP session establishment issues and that delayed the change a lot as we couldn't figure out the issue. The issue was the BGP authentication failed. Once we disabled BGP authentication, BGP session got established. Is there a w...

Timeout while exporting a device state into a TFTP server

Hi, I'm trying to export a device state from the Panorama CLI into a remote TFTP server, but I get a timeout.Both the Panorama and the TFTP sever are on the same network, so the traffic does not pass the firewall.Also, there's over 200 GB of free space on the TFTP server, so the problem is not a lack of space. What's the reason of the timeou...

Variables is DNS Proxy rule?

Hi, My question would be, is it possible to use template variables to set primary end secondary dns for DNS proxy rules in Panorama? I can set a static entrys' IP address value to a variable defined in the template, but can't find the way to do the same for proxy rules. Context: Our branch offices each have their on subnet, doman controllers an...

Resolved! global counter tcp_case_2

I am running a set of vm-series VMs on Azure. From time to time there is packet loss for traffic going through one of these VMs, I am trying to find a metric to monitor that. I could not find a metric exposed through SNMP, but looking at the global counters that increase during TCP retransmission, I found "tcp_case_2" global counter seems to mat...

Unable to downlode PAN-OS for VM-Series KVM Base Images

Hello Team, I am not able to downlode PAN-OS for VM-Series KVM Base Images. we gating below error.

Resolved! A question about ECMP

Hi， I saw a function named ecmp on palo alto NGFW, I think that it can make outbound traffic load balance on two or more physics line or logic line. And I also saw there was a inbound interface information in the session table of firewall. So I want to know if there are two out line on the firewall and connect to outside network named por...

Resolved! Can you sort security policies by the hit count?

Hi; Can you sort security policies by the hit count?. I could not do that, but thought I would ask. KindlyWasfi

Resolved! SNMPv3 read-only permission

hello all, i'm trying to create snmpv3 user account with read-only permission but when i went through the option on GUI there was nothing about specifying the permission whether it's read-only or read & write. i would really appreciate the help.

How can I search a particular source&destination address in lots of security policys？

Dear all: I have a question about search security policys. We have lots of security policys on our pa ngfw. some of them use a address group as a source& destination condition, some are not. The content of address-group may be a range or a subnet, but now I want to search security policys that relate a pariticular address, this add...

Question regarding Signal messaging application

Currently have a PA-440 at home and trying to setup Signal messaging application. I know the application is cert-pinned and therefore cannot be decrypted. To get it to work, I added to the SSL Exclusion Decryption list the following hosts/domains per the Signal website: https://support.signal.org/hc/en-us/articles/360007320291-Firewall-and-Int...