This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
General Topics
Post a discussion here if you have general questions regarding configuration and troubleshooting for Palo Alto Networks products. Use this forum to collaborate with like-minded security professionals to improve your security posture.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
General Topics
Post a discussion here if you have general questions regarding configuration and troubleshooting for Palo Alto Networks products. Use this forum to collaborate with like-minded security professionals to improve your security posture.
About General Topics
Post a discussion here if you have general questions regarding configuration and troubleshooting for Palo Alto Networks products. Use this forum to collaborate with like-minded security professionals to improve your security posture.

Discussions

Start a conversation

Block layer 4 traffic for destination blocked on URL filtering

We have a very peculiar situation. There is Azure public PaaS environment connected over express route and we have a Palo inline. Now the destination ip/subnet range is dynamic but we just end to allow few specific URLs. It was all fine where we had url filtering allowing the required destinations and blocked everything while testing from a web ...

Biswa by • L0 Member
  • 4241 Views
  • 3 replies
  • 0 Likes

PAN-OS 9.0 URL DB manual Download not available

Hi, not sure if I to stupid to find it, but after upgrading to PAN-SO 9.0 there is no more option under Licenses URL DB to download the URL DB manually. In an Active/Passive Cluster the Active Firewall downloads the URL DB every few hours, but the passive one sits there with no URL DB. Just a cosmetic thing as the URL DB gets downloaded once yo...

holbem by • L1 Bithead
  • 6124 Views
  • 3 replies
  • 0 Likes

Resolved! Untrust interface we have created Global protect gateway

we have separated GP portal and GP gateway interface.Untrust interface we have created Global protect gateway and we allowed ping on the interface but when we are typing untrust interface IP address on our browser eg https://112.20.20.1 . We are getting the above message 502 bad gateway.Qustion :we have only allowed ping on GP gateway interface ...

Sonu_Singh_0-1595145568421.png
bit_byte by • L2 Linker
  • 6165 Views
  • 4 replies
  • 0 Likes

Resolved! exclude-access-route is an invalid ipv4/v6 address

Hi All,, I'm getting this error, see attached, when trying to add new routes to Global Protect Split Tunnel config. Only thing I can think of, we're running v9 on Panorama and v8 on the firewalls. do the firewalls not like the format when trying to push to them? they are due to be upgraded to same v9 end of this week, wait and try again after? Ian

MicrosoftTeams-image.png

Why do unused rules show traffic hits?

I am doing cleanup of old unused firewall rules. Using the UNUSED policy optimizer I noticed that some rules are showing Traffic usage but 0 hits? Can someone explain why this is? I am wary to trust the HIT count until I understand the correlation. Best guess is that it tracks what apps would have hit it?

PeteHalatsis_0-1595009863372.png

Block Tor application traffic.

Hi We are planning to block Tor application traffic in our PA device , so do we need to write security policy in both the direction and also share the steps to block the traffic in Palo Alto device. Thanks,Yusuf

Yusuf_PA by • L1 Bithead
  • 12534 Views
  • 10 replies
  • 0 Likes

radius authentication issue

After the device PA-500 is upgraded from 7.1 to 8.1.15, the radius authentication of the user name and password of the device fails, and we can only log in to the device through local authentication. After performing Radius-related configuration according to the configuration guide, the account login still prompts "invalid account or password" l...

Eccomtac by • L0 Member
  • 4198 Views
  • 1 replies
  • 0 Likes

PAN-OS 8.0.15 issues X SNMP

We updated the 2 pair of Firewalls on last sunday to 8.0.15 and after that our CACTI stop to show the interfaces statistics from PA-5020.Cacti is monitoring the updated PA-3020 correctly. The issue only happen with PA-5020.Did anyone experience something related ? Regards,Marcelo Castro

mmcastr by • L1 Bithead
  • 2397 Views
  • 1 replies
  • 0 Likes

PBF with nat

Hi So I have 1 internal address that when it goes out via the PA to the internet (SNAT) i want it us a specific route - net hop. So it looks like I can't set pBF on source address (SNAT). has to be on the original address.and I can't specify outbound internet

Resolved! Question about Active/Active HA with Layer 2 Interfaces

Hello, I have read the Administrator's Guide and the Use Cases for Active/Active HA but just wanted to get some confirmation that I am understanding the requirements correctly. We have two identical Palo Alto firewalls that we want to setup HA with. We will be configuring a Layer 2 Aggregate Interface with subinterfaces and then connecting it to...

Global Protect new Linux UI

I have the GP Linux CLI client working without any issues, however I wanted to test the UI client that just came out (5.1.0) Does anyone know how to actually use this? The PAN documentation has not been updated to mention this new version or the Linux UI yet. Installing it goes fine but I do not see anything installed to my desktop and when atte...

hshawn by • L4 Transporter
  • 42175 Views
  • 18 replies
  • 0 Likes

Getting PAN FW logs to Azure Sentinel

I'm currently sending FW logs to Azure Sentinel, via syslog over SSL to an r-syslog server with the Azure agent on the syslog server forwarding logs to Sentinel. I followed the documentation, format is BSD header with custom CEF format for the logs added. Using local4 facility on PA side as well as r-syslog server. Logs are getting in, but they ...

threat log.JPG

Microsoft Direct Access - is user Identification possible?

Hi,We have user identification working nicely using user ID agents on a few of our active directory domain members.I've been looking at MS Direct Access (and formerly UAG) and it seems that a DA implementation would show all connected users as having the same source IP address and therefore user ID. (The private IP address of the DA server.)Do P...

Palo alto not blocking a URL

Hi All, I hope all are doing well. I am trying to block a URL on palo alto firewall using custom URL category but firewall is not blocking the traffic and its passing through allow SSL/Web-browsing rule just below it. This is the rule i created: Rule 4 is allow rule to access websites, whereas rule 2 is used to block the URL - https://natboard.e...

Ankurdatta_0-1594630363624.png
Ankurdatta_1-1594630694984.png
  • 24396 Posts
  • 123 Subscriptions
Top Solution Authors
View All
Labels
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks