General Topics

GlobalProtect user always returns authentication failed

(T14508) 05/04/20 09:48:34:904 Info ( 474): msgtype = user_credential(T14508) 05/04/20 09:48:34:904 Debug(2642): ServerThread: ProcessServerUserCredential. Redirect to processServerPortal.(T14508) 05/04/20 09:48:34:904 Debug(1714): ----portal processing starts----(T14508) 05/04/20 09:48:34:904 Debug(1736): User profile type is 0(not roaming)(T14...

ACC tab "Applications using Non Standard Ports"

Hi PA Live Community, Still a newbie to the whole PA world but slowly getting there.When looking at the ACC tab of the GUI I can see there are entries for "Applications using Non Standard Ports" and also "Rules allowing Applications on Non Standard Ports" Screenshot attached below.Can someone explain why this is alerting as it is? I am using A...

How to replace one Faulty Paloalto 3250 version 8.1.6 Firewall which is in HA.

Hi All, I need help on how to replace one Faulty Paloalto 3250 firewall PAN OS version 8.1.6 which is in HA and policies are managed through Panorama. your help is highly appreciated and thank you so much. thnxJP

Testing non-http mfa feature with GP

Hi there. Documentation is rather slim here. I've set ut MFA for web site access, and it works. When testing it for non-http, accessing a SSH server, it kills the SSH connects, but no 2FA challenge on my GP. What am I doing wrong? What's needed? I've done this: "Set Enable Inbound Authentication Prompts from MFA Gateways to Yes" https://www.pal...

Resolved! HA1 Backup Down - PA220 9.0.4

Hi All,I have followed the PA design for creating an HA Active/Passive pair of PA220s. I see however that HA1 Backup is showing red/down. Attached are the relevant sections and a High Level Topology of the HA setup. Any advice?If I reboot the active PA the Passive one does take over so not sure what issues this HA1 is causing if any.Also, the ma...

Resolved! SSL Decryption URL and App Filter

Hello everyone,I have to block some URLs and applications as per our company policies. Since we dont have a general rule from the inside zone to the outside (Internet), we are very restrictive in our access to the internet, and since there are some websites and applications that we need explicitly to block no matter what, what I did was create a...

Firewall is limiting concurrent users for GlobalProtect

We are using PA-VM-300 and it should allow 2000 vpn users concurrently. Our global protect IP pool is configured for /23, so firewall should accommodate 500 users, as it is having enough IP available in the pool. For some reason, when the other firewall failed due to internet outage, the main firewall did not allow more than 260 connections. We ...

Resolved! Outbound RDP access

I just heard one of my coworkers saying we need to block outbound access to RDP, I didn't have chance to follow up with him what him because of COVID-19. I am trying to to understand what would be the reason, is that a best practice possibly?

FIPS 140 and CC enabling?

Couple of questions on FIPS. When you enable FIPS140 on a Palo it wipes the device. Can you just reload your last saved?Can a FIPS140 enabled device talk to a non-FIPS device over an ipsec tunnel provided the cyphers are compatible?FIPS disables PAP. System wide? or Just for authentication to the FW? Our Radius doesn't support CHAP.Anything else...

L3 sub interface traffic monitoring

Hi There, How can I monitor l3 subinterface traffic - current & historical. mainly Bandwidth utilization. Thanks

Rdp windows

Hi,is it a good idea giving access to public windowd rdp ?.Folks says do not publish outside Any good reason for this ?Thanks

how to create a log forwarding profile using gmail or office 365

Hi I am trying to create a log forwarding profile in the firewall and parallel we created the server profile for the Gmail and office 365 while scheduling the report and used the Gmail or office 365 email id and we try to test the email we are getting the below error we have added the mail server profile. we schedule the reports and getting er...

Resolved! Cleanup Rule

Do you recommend creating a cleanup rule (last rule to deny any any) in PA? As far as I know, PA firewalls only allow traffic explicitly defined, and the last DENY is a built in "known rule"…correct? or will the interzone policy take care of this?

Resolved! Virus/win32.wgeneric.ajgdai id 341892366

Hi Team, I have issue. One user connect to SSL VPN, and cannot ping one IP 192.168.1.11. Only one IP. after i checking at firewall, I found this users got blocking activity Threat Name virus/win32.wgeneric.ajgdai id 341892366. But when this users using mobile hotspot. him can ping this IP address 192.168.1.11. Palo Alto PA-220 Thanks

Resolved! VmFirewall on Xen?

Hello, good morning. I have purchased the vm300 virtual firewall.I have seen that no downloads are available for the XEN hypervisor at this time.There are for vmware, kvm, citrix netscaler, etc.I finally got the vmware virtual machine running on Xenserver after adding some xen libraries so that the parts could communicate correctly.But I wonder ...

Discussions

GlobalProtect user always returns authentication failed

ACC tab "Applications using Non Standard Ports"

How to replace one Faulty Paloalto 3250 version 8.1.6 Firewall which is in HA.