This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
General Topics
Post a discussion here if you have general questions regarding configuration and troubleshooting for Palo Alto Networks products. Use this forum to collaborate with like-minded security professionals to improve your security posture.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
General Topics
Post a discussion here if you have general questions regarding configuration and troubleshooting for Palo Alto Networks products. Use this forum to collaborate with like-minded security professionals to improve your security posture.
About General Topics
Post a discussion here if you have general questions regarding configuration and troubleshooting for Palo Alto Networks products. Use this forum to collaborate with like-minded security professionals to improve your security posture.

Discussions

Start a conversation

Resolved! What traffic will be generated when select "Collector Group communication" on ethernet1/1 on panoram

Hello Everyone, I deploy two VM Panoramas for ha, and checked the setting "Enable log redancy across collectors" under Collector Group. Because of the both two log-colllector can copy logs each other, so I would like to separate function "Collector Group communication" to ethernet1/1, and use a cablle to connect directly for two vm panorama. My ...

Cisco Policy Based VPN - ProxyID Query

Hi everyone, I am receiving the below error on a Palo to Cisco policy-based VPN. 'IKE phase-2 negotiation failed when processing proxy ID. cannot find matching phase-2 tunnel for received proxy ID. received local id: 10.45.33.253/32 type IPv4_address protocol 0 port 0, received remote id: 10.104.58.0/24 type IPv4_subnet protocol 0 port 0.' Does ...

baz00r by • L0 Member
  • 3038 Views
  • 2 replies
  • 0 Likes

Resolved! Security Policy destination and/or URL category clarification

Hello, can someone please tell me the best way to implement minemeld custom IP and URL blacklists? We have just built a minemeld server and have both a list of IPs and URLs. Currently have just one OUT rule like below but should we have 2 - 1 for IP destination and 1 for ANY destination but for particular URL category? We are unsure if the URL c...

michelle79_0-1575864515370.png

Generating SSL Decryption Forward Trust Cert for an HA Pair via Panorama?

I've successfully rolled out SSL Decryption on a bunch of non-HA firewalls via Panorama. Generating the .CSR, signing it with my CA, and then importing the .CER but I'm wondering if this is going to work with my HA Pair because I'm guessing that I'll have to have two different certs because there's two different physical boxes. Has anyone done t...

Resolved! Force Template Values

Hi If someone overrides a setting locally on firewall, can this be further overidden by Panorama using force template values? ... and is that instance what happens to the green and orange cogs? Thank you

nawaza by • L2 Linker
  • 8997 Views
  • 2 replies
  • 0 Likes

Router on a stick with VLANs

I have a single HPE 5400 that links to a PA-820. I have an untagged p2p VLAN on a Layer3 interface on the PA. I use this as the "MGMT/LAN" side. The HPE is doing routing for internal networks. To add another VLAN, I tagged that same port on the switch, and I add a sub-interface on the PA with the appropriate tag.So, the uplink between the switch...

Resolved! minemeld-engine FATAL Exited too quickly (process log may have details)

MINEMELD 0.9.44 2018-01-30T13:55:26 (4857)mgmtbus.checkpoint_graph INFO: checkpoint_graph called, checking current state2018-01-30T13:55:26 (4857)mgmtbus.checkpoint_graph INFO: graph status None, checkpoint_graph ignoredTraceback (most recent call last):File "/opt/minemeld/engine/current/bin/mm-run", line 11, in <module>sys.exit(main())Fil...

IrekSw by • L1 Bithead
  • 13628 Views
  • 13 replies
  • 0 Likes

Export traffic logs in CSV

Hello All, I have tried to export logs from firewall its reach limit up to 1048576 rows, this is only for 3hr logs can anyone have the option to filter logs or can we exceed this limit.?

proxy_arp_pvlan

Hi all, I was dealing with a scenario recently which I eager to use the Palo Alto firewalls.In my design, it is a must to use the feature which is called ARP alias in Cisco terms, and ARP publish in Juniper terms. In case of Linux as Palo Alto is using is proxy_arp_pvlan.the explanation regarding to the proxy_arp_pvlan is as follows which is der...

seek_2 by • L1 Bithead
  • 7163 Views
  • 3 replies
  • 0 Likes

Resolved! types of PA firewall inspection

Hello community! I have a question, checking my stick high firewall, I wanted to know if in my firewall I could configure the inspection mode. I have seen another product from another manufacturer that has 2 inspection modes that are the flow mode and the proxy mode. I would like to know if in stick high I also have that functionality available,...

HIP Check licensing expired

I thought that HIP check licensing expiration (trial version), would cause any rules on the FW - using a HIP check profile column to not match. Instead, it appears that it causes the firewall to simply not care about that column at all.... and allow traffic through, on the rule with the HIP check profile specified, even if you are out of compl...

Sec101 by • L4 Transporter
  • 3882 Views
  • 3 replies
  • 0 Likes

Resolved! Global Protect Saving User Credentials Security?

After reviewing a few documents, I'm hearing that doing this is not a best practice.... If I choose to do so, does anyone know where those credentials are saved and how they are saved in the agent on the endpoint? I'm guessing encrypted cookies are the way to get around this with longer validity times?

Sec101 by • L4 Transporter
  • 34229 Views
  • 13 replies
  • 0 Likes

TCP TimeOut caused by the PA?

We have a video app that is streaming through our Palo Alto firewall on port 80. Everyone once in a while the session fails and can only be revived by hitting refresh in the browser. I am dealing with a network manager that's convinced the PAs are Resetting the session.Before I go through the hassle of creating override policies for port 80 with...

jhickey by • L3 Networker
  • 25194 Views
  • 15 replies
  • 0 Likes
  • 24477 Posts
  • 125 Subscriptions
Top Solution Authors
View All
Labels
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks