General Topics

Disable TLS 1.0 and 1.1 and also weak cipher

How to disable TLS version 1.0 and 1.1, also to disable weak cipher for WildFire Configure Authentication with Custom Certificates on the WildFire Appliance I went through this KB it shows how to disable the 1.0 and 1.1 but how to disable weak cipher in wildfire

In Wildfire how do we disable weak TLS ciphers?

Nessus scanning is picking up TCP/443 TLS v1.0 and v1.1 on our WildFire (WF-500) appliances. Is there a way to turn off TLS v1.0 and v1.1 on the WildFire ? Below is the Nessus scanner notification.--------------------------------------------------------------------------------Policy Violation 443/tcp Nessus ID: 56984-------------------------...

Resolved! Request for Upgrade Advice on Palo Alto Firewall PA-1410

Dear Palo alto network Team,I hope this message finds you well.We are currently running a Palo Alto Firewall PA-1410 with software version 11.2.3 and are planning to upgrade to a newer version. After checking the available software versions, we have attached the relevant file for your reference.Could you kindly advise us on the most suitable ver...

preferred PAN-OS software versions table

HI, dear PaloAlto team, Why has the preferred PAN-OS software version table been changed? The previous view was much better, because it allowed to select the preferred software version and schedule changes....Now there is only one preferred version and no information about new, monitored realases. GreetingsJacek

Google-base app, what its cpable of in escense of google apps.

Hi Team, Recently, I had to allow an internally developed android and IOS for users that are allowed and not allowed to access internet. this app "externally hosted internally developed" role is consisting of destination IPs and web-browsing app. For the android side, it didnt work untill I allowed the Google-base app in a separate "...

Resolved! Geo Location A1 disapeared

We've been using source region A1 (anonymous IPs) as source in a block rule for over an year. Today, while validating an unrelated change, we came across a validation error stating "Source 'A1' is not an allowed keyword." Panorala and Firewalls are all running PAN-OS, its running 11.1.4-h7 and we have not updated it recently. I must assume a ne...

Dynamic ports to Static

Hi Team, I'm trying to configure the Dynamic ports (49152-655355) to static 37001 . We have destined server which is sending dynamic ports to establish the link and data exchange. what is best option to have this hardening.?

Resolved! Error during Commit operation

Hello, if you encounter this while performing a commit: Error: Certificate 'XXX' failed to load: parse tbs certificate dn failedError preparing global objectsfailed to handle CONFIG_UPDATE_START try these commands in the CLI: debug dataplane reset ssl-decrypt certificate-cachedebug dataplane reset ssl-decrypt session-cache i don't know why...

Resolved! Palo Alto Software Visio files

Hi all, I am looking for the Visio stencils for PAN Azure deployments. There was one floating around that contained all the Azure deployments etc which was really useful. I think it was for Cyberforce members only but I can't seem to find it. https://www.paloaltonetworks.com/company/press-kit I know of the above link but this only contains...

URLfiltering Response page for Override with redirect mode does not work

I created a loopback interface that has the Response Page management option enabled. I setup up the override action for social-networks category in the URL filtering profile and setup the Device->Setup->Content-ID on override with the IP loopback address. Block and Continue actions work properly with other categories, however Override acti...

How to get the full CA Issuer URL when it is truncated in the decryption log

Hi guys, I am checking the decryption logs, to repair the certificate chain as mentioned in the guide below:https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/decryption/troubleshoot-and-monitor-decryption/decryption-logs/repair-incomplete-certificate-chainsThe issue is some cannot provide the full URL of the missing root CA/Issuer, for ...

EVE-NG Setup & VMWare installation for Palo Alto & Multi vendor devices

VMWare installation & EVE NG Setup step by step for Multi Vendors Devices As for every IP Network Engineer readiness of the simulator especially the multi-vendors environment, EVE-NG is a big headache. But honestly, this is very simple and only needs a few minutes to focus. Highly request that Please follow the exact steps that I will do b...

PanOS 11.1.5 (and others with the fix for CVE-2024-2550) still not preferred?

Might anyone know why 11.1.5 and 10.2.10-h10 (or anything newer) are still not marked as preferred 3 months after release? We're on 10.2.x now and likely would upgrade to 11.1.x, but I figured waiting for the patch for CVE-2024-2550 makes sense. CVE-2024-2550 PAN-OS: Firewall Denial of Service (DoS) in GlobalProtect Gateway Using a Specially...

Resolved! Device Certificate fetch failure

Version : 10.1.6-h3 Issue/ Error log : Failed to fetch device certificate. Failed to send request to CSP server. Error: No OCSP response received(dest => 35.222.13.89) Tshoot : Generated OTP over support portal but no option for me to key in the OTP KB unable to resolve : https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0...

Two separate PA one the same ISP on both location

Hi, we have two PA fws around 1km in bettwen. They are connected with dark fiber so users on both side can see each other.One the same ISP on both side, and public IP address range of /28 addresses. We are using that public IP address for several services (each service has its own public IP) and want to configure both PA so when PA on primary ...

Discussions

Disable TLS 1.0 and 1.1 and also weak cipher

In Wildfire how do we disable weak TLS ciphers?

Resolved! Request for Upgrade Advice on Palo Alto Firewall PA-1410

preferred PAN-OS software versions table