General Topics

FQDN Addresses

I need your help on this please. Is it possible to have a wildcard FQDN as a source or destination address (example *.microsoft.com) Is is possible to mix wildcard FQDN with a non wildcard FQDN in an address group (example add in *.microsoft.com with google.com in the same address group) Thanks in advance.

Correlation Event logs are not showing the same values as in Summary

Hi, We have configured the firewall to forward the correlation event logs to the syslog server. We started verifying the logs in syslog server and found the logs were not matching, all are showing the same value in the syslog server "host visited know malware URL (11 time). Whereas in firewall we see random values. In Firewall:In Syslog server:P...

Dual ISPs and PBF

Hi I have 2 ISPs on my PA 3220. I need to set it up in a way so our core traffic passes through ISP1 and guest WIFi and other non-critical traffic passes through ISP2. Also I need to make ISP2 as my backup ISP if ISP1 goes down. I have read about creating 2 VRs anfd setting up PBF but not too sure how to accomplish this fully.

Early License expiry

Hello Everyone. I am running into a license expiry problem with couple of PA firewall deployed in a customer site. There are several subscription based licenses based on the portal that are gonna expire around 29th of July this year. However the license page on the firewalls shows up expiry dates as 30 days early i.e on June 30th instead.Has any...

Enable Global Protect from Linux

We have a problem in being able to enable Global Protect from Linux, see detailed information about the problem to guide us about it. I am writing to ask for help with a situation that I have been trying to solve for a while. I know that the Windows and Mac computers have an application to access the VPN and when you install it and follow a few ...

Resolved! Moriagent malware

Dear Team, I don't have much idea about Moriagent malware, i got an instruction i need to create a rule or block this malware How to stop MortiAgent Malware using snort rule? I want to stop the MoriAgent malware by applying /using snort rule.How to configure this in Palo alto ?Below are snort rule.1. The below SNORT rule can be used to detect t...

Resolved! Software Upgrade issue 8 > 9

I'm currently running 8.0.6 and trying to upgrade to 9.1.3. I'm trying to install per the recommended stepped upgrade, but having zero luck. When I use the WEB GUI to upload 8.0.13 or 8.0.20 it says "PanOS_800-8.0.13 saved" or "PanOS_800-8.0.20 saved" but it never shows up in the software tab on the GUI. I try to install the software through CLI...

Resolved! Panorama modes

Hello, I have read about Panorama's modes. But I would like to know if Templates and Group Device's configurations are available without matter what mode is the VM/Physical device. As I understand the documentation, the Panorama's mode only determines how logs data is stored. Thanks in advance. Regards,

Resolved! Two Palos (not paired) on the same LAN have duplicate MAC addresses

I have two datacenters each with independent Palo Alto setupsEach site is configured Active/Passive, there is no peering of the Palo's at one site, with the Palos at the other site.My Cisco L3 configured switches are reporting a duplicate MAC address ( on the ports connected to the Palo) and on a connection to my nexus switches.The nexus switche...

Resolved! Panorama Upgrade

Hi All, I carried out an upgrade on a Panorama appliance this morning, M-100 model. Went from 9.0.6 to 9.0.9-h1. Process was fine however it needed a cold boot (pull power cables) to recover, it did not come back on its own. Couldn't even console to it. Left it for over 3 hours. My question is are there any logs within the unit I can retrieve to...

Blocking ilovepdf application on Palo Alto

There is high risk app (ilovepdf) used which got identified in CASB in our corporate network & management informed to block this app in Palo Alto. Please let me know if there is any option to block ilovepdf app only specifically in Palo Alto firewall.

Palo Alto - SSL ciphers that offer medium strength encryption

We used Nessus tool to run security scan on the PA-5020 & PA-3020 series & it identified with the following below medium vulnerability:"The remote host supports the use of SSL ciphers that offer medium strength encryption" Please let me know, for any fix to this vulnerability. I found one solution for the same in below link. Just want t...

Resolved! Traffic from GlobalProtect stop working after upgrade from 8.1.11

Hi,I have two PaloAlto 3020 in an active-passive cluster. PanOS 8.1.11 is nstalled on both. Everything works correctly, internal traffic, traffic from GP Client, vpn tunnels. GP clinets connect, sends HIPs, Palo recieves this HIPs, traffic is passing trough according to rules.The problem is that when I updated one cluster node from version 8.1.1...

Resolved! Error message in System logs

We have a PA that is displaying this message every 60 seconds for some reason. "highopaque: DO NOT CHOOSE WMI in ADGMEL03 FOR YOUR USE CASE IF SEE THIS LOG AGAIN" What is it indicating and how to turn it off?

Problems with the support Portal

Hi Team, I need to open a new case from the portal, however pressing the create case button gives me an error and does not allow me to even verify the cases that I have open. Regards,

Discussions

FQDN Addresses

Correlation Event logs are not showing the same values as in Summary

Dual ISPs and PBF

Early License expiry