General Topics

SSL\TLS Profile deployment via Panorama

We have a Panorama running 8.1.9 and were looking to utlize almost every setting possible in Panorama to deploy to our managed firewalls. One of the settings we are looking to standardize on is the SSL\TLS profile. I see you can set this via Panorama but it requires you specify a certificate. Does this feature deploy the actual certificate or j...

Resolved! PA 850 does not show all interfaces in CLI and web gui

I found on some PA when you do show interface all from cli it does not show all interfaces why is that? Also on Web gui it does not show all interfaces? any reason for this behaviour?

Resolved! External Dynamic List

Hi, We are planning to use URL type EDL (external dynamic list) in a security policy rule / URL filtering profile. Does PA translate the URL in the external dynamic list to IP address? using FQDN refresh (like if we created an FQDN object in the firewall) How does it work exactly? any inputs would be appreciated. Thanks

Resolved! PA-220 FIB limit

HiKindly I need a feedback about how many maximum routes PA-220 supported to learn from OSPF Neighbors ?ThanksKonrad

Config not reflecting on firewall when pushed via panorama

Hi , We are facing unusual issue in our enviorment .We have pushed the changes from Panorama to devices but changes are not reflecting on individual firewall . Verifed commit logs , no error . All showing result succeeded . Panorama version - 9.x.xFirewall version 8.x.x Anyone faced similar issue ? Or any suggestion regarding same. Thanks .

Resolved! GP gateways under the same ISP

Hello , I have setup for the company portal and gateway with a specific IP pool and there is one pulbic IP on the ISP. Now they want partners to connect as well and I was wondering if is possible to have either on the same gateway another VPN IP pool and setting like DNS or I can make another gateway under the same IP with another port.

URL Filtering logs

I am using PA-500 on the version of 8.0.18 i am not able to see the URL filteing logs which has the host accessed the URL's from IP too.Kindly guide me

Upgrade

Hello Everyone, I have a PA 5020 in version 8.0.9, what is the most stable version to update?

user-id user name issue

Hi Team, I'm getting NETBIOS name instead of domain name. How to resolve this issue RegardsVenky

Stack override template with IP of none

I'm trying to use the same "interface" template for all of my locations. Unfortunately not all locations have the same number of subinterfaces. I'm trying to override subinterfaces that aren't needed at the stack level somehow so that they are pushed as "null" or "no ip". Any ideas, suggestions?

Resolved! ssh access to mgmt interface after enabling fips mode

i am checking documentation and knowledgebase and it seems only ui access to https://192.168.1.1 is available after fips is enabled and firewall reboots.Can anyone confirm if ssh to 192.168.1.1 will work as well or not?

HA Setup

I have firewall in HA(A-P) mode.If device priority is same on both , will there any delay in switching A-P role during failover activity ?

config on passive & pushing to active ?

Dear All, As I have always been practicing to do the configuration and changes on the primary device and then it is its responsibility to push the configuration on the secondary device but as I have also been seeing people to do the configuration on the secondary devices be it juniper, F5, Palo and they really don't consider this active passive ...

PAN-SA-2019-0020 ... really?

Hello Paloalto Team Last thursday you published the securityadvisory for a critical RCE vulnerability and today you notified the customers again with an "Action recommended" article here: https://live.paloaltonetworks.com/t5/Customer-Advisories/Action-Recommended-Recent-Security-Advisory-PAN-SA-2019-0020-Ref/ta-p/278505 In this article you write...

session end reason threat

We have vendor traffic coming to PA and session end reason is threat.Under threat i can see the threat id numberThey are lot of them For easy way I have disabled the security profile vulner protection for that rule. Need to confirm by doing this PA should not end the session with threat right?

Discussions

SSL\TLS Profile deployment via Panorama