Hi ! We are migrating to Palo Alto from ASA Where ASA TCP normalization is enabled for option 28. How we can achive the same in Palo Alto ?
We have deployed GP full tunnel VPN across the enterprise. We have some departments using OpenVPN, My question is why can't users use OpenVPN without having to disable GP first. thanks,
Is there any way to tell before installing an agent upgrade if the agent is going to want a restart or not?
Hi All, I have created a custom response page for a vsys but I need two of these within a VYS so they are served depending on the source IP address. Example, if user comes from within 10.10.10.0/24 I want to serve a response page with policy details for customer Aif user comes from within 10.10.20.0/24 I want to serve a response page with policy...
Dear All, Kindly help me understand below query - We would like to configure Security Policy Action "Block IP" for Critical, High and Medium level Vulnerability signatures for 3600 sec. As per understanding traffic from source-destination pair; Configurable for a 3600 seconds (period of time) will be blocked. However request you to clarify whet...
Hi folks. I'm running into an annoying issue with some Windows 10 workstations and Global Protect. Global protect will install, and run for an unspecified (and variable) time on a given workstation. Connected, working, no problems. After some period of time, for no reason, it just won't connect. Sits at "Still Working" in the status box and neve...
Hi all, When i trry to commit this error appear:I tried to restart the system but withous success.
Hello everyone, Been testing some PA firewall functionality and noticed that ms-rdp has the implicit use of "cotp" defined, but the cotp application matches to a rule further down the policy list. When I review the logs, it looks like this Am I misunderstanding having cotp as implicitly allowed by the ms-rdp application? Not sure why ms-rdp is a...
We have PA-820 deployed in Active-Passive HA mode running PANOS 8.0. Today i received a notification that PANOS 8.0 will be End of Life on 31st Oct 2019. Hence I have to upgrade the PANOS of both firewalls, preemption is enabled on both firewall. Please share the procedure / best practices of upgrading OS in HA (Active-Passive) with no traffic o...
I have 8900 user-ids in my environement. using PA-5020, is it advisable to have both user-id agents turned on? I would like to have as much reliability as possible so the security policies will accurately filter based on usernames. thanks.
We have Panorama installed in our DMZ, behind a PA5220. Management interface for Panorama has a 10.10.10.x IP, which gets NAT'd to a public IP. Currently running Panorama 8.1.10 in panorama mode. All of our firewalls (currently PA200/PA500 with PanOS 7.1.x) connect to Panorama using the public IP. All of the firewalls have private 10.x.x.x IP...
I have successfully deployed MFA for my Global Protect users using PingID. Using RADIUS and LDAP I am able to have a user challenged every time they want to fire up the Global Protect gateway. However, this functionality only happens when a user has their device pre-enrolled into the PingID portal. If the user doesn't have a PingID account with ...
I upgraded a few pair of IPS/IDS devices last night and ran into an odd issue I haven't seen when upgrading other devices before. They run, typically, in Active/Passive mode, so when I upgrade I suspend one, upgrade, reboot, unsuspend it, and then repeat the process on the other device. Last night after I walked through this process the devices ...
Hi,How can we deny simultaneous Vpn logins more than one user with same user name ?Thanks.
Hi ! We are trying to configure Destination NAT rule for a VC device on Palo Alto 820 NGFW. we need to allow range of TCP ports(Ex:3000-3050) but we could not find the option to configure the port range under the translated tab. find the below requirement for your reference.Original Packet: Src.IP:Any, Dst.IP:1.1.1.1, DstPortrange: 3000-3050Tran...
OtakarKlier
on:
SIEM posting Botnets , but Firewall do not
BPry
on:
Captive portal auth doubt
