General Topics

VPN client to site don't much the local dns register

Hello, I have configured the PA-500 firewall with VPN client to site tunnels . The VPN tunnels work correctly but i can't reach the local servers name on the DNS.I add our local DNS address on the agent gateway setting of Global Protect without result.Should I add another configuration to reach the record local DNS? Thanks in advance for your c...

500 INTERNAL SERVER ERROR

Getting "500 INTERNAL SERVER ERROR" while doing preview config/commit using GUI in panorama . Any suggestions . Thanks ,

Apple Airplay between zones

Have anyone try to get apple airplay to work between firewall zones? TIA, E

Resolved! Queries on GP and PANOS

Hello, 1. We have installed GlobalProtect64-5.0.1. However after updating the client when I connected via VPN, it asked me to downgrade the client. Why is it so? Do we need to downgrade? 2. Can you suggest us which version of firmware will go with GlobalProtect64-5.0.1? Current releases are recommended as of now:In version 8.0 series---> 8.0....

Resolved! GlobalProtect 5.0.2 Issues?

Anyone experiencing any issues with GP 5.0.2? I started an upgrade this week. So far so good, but a few users experienced an odd issue during the upgrade. You'd click download, then when you click install, their screen went completely black. The upgrade completes successfully if you want it out but have to restart the explorer.exe process to...

IP to local address object/hostname resolution.

Prior to an upgrade Panorama was able to resolve an IP address to the host/object name of a local address object.For some reason, the resolution has stopped working and support seems to not know what I am referring to but yet it is discussed here https://live.paloaltonetworks.com/t5/General-Topics/Dispaying-object-name-in-traffic-monitoring/m-p/...

Resolved! Pinging Palo sub-interface reply goes to 00:70:76:69:66:00 as a destination MAC.

Hello All, l was thinking that this might be an interesting one. Any comments more than welcome 🙂 PAN-OS 7.1.10 PA-5060 635 66.604593 10.13.178.246 10.13.128.1 ICMP 394 Echo (ping) request id=0x0029, seq=0/0, ttl=64 (reply in 636)Ethernet II, Src: Apple_7e:b6:ff (38:ca:da:7e:b6:ff), Dst: PaloAlto_00:01:27 (00:1b:17:yy:yy...

Python Script

From Pan-OS 8.0 - 8.1.6, there is a bug when using FQDN's in rule sets. Until we're ready to upgrade, I need to run a script to force a FQDN refresh, cli is "request system fqdn refresh force yes". I'm really new to Python, but have created my API Keys. Anyone have some guidance to pass along on how I can build this script?

NAT Only works part of the time

Ok, Who knows what's going here...Here is my Scenario.. We're looking at a new Phone Platform and I'm only able to get a NAT to work part of the time. First, when the IP Phone loads, internal address of 172.23.1.1, It connects out to the Platform IP of 55.66.77.88, downloads the config from it's TFTP Service. Since we don't want our Voice traf...

SSH connection drops randomly

An SSH connection to a particular server drops randomly (usually 20-60 seconds after login). Between the client and the server is a Palo Alto firewall with SSH decryption disabled.What I tried so far - regenerated ssh keys on the server - added to server config: ClientAliveInterval 30 ClientAliveCountMax 5 - added `ServerAliveInterval=10` to ssh...

PA-5220 Decryption Performance Degradation

We have a cluster of PA-5220 firewalls with SSL decryption activated. When initiating a communication across the firewall using a decrypted protocol (scp, HTTPs, etc.) we get 5x slower connections compared to the unencrypted versions of the procotol. In Certificate Revocation Checking, CRL and OCSP are unchecked. Is this behaviour expected? If n...

Resolved! How to remove Panorama setting from firewall without losing any setting

Client firewall had been configure with Panorama but no more panorama. Any new setting need to change we do mannually. But still firewall showing panorama setting with read only. How we can disbale or remove panorama setting without losing any current setting. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cmd6CAC Othe...

Resolved! IP Sec VPN Paloalto - Mikrotik

Hi! I have a situation that is doing my head in, and I need some help. I have an installation which looks like this "A" end - Palo Alto Active/Passive cluster, public IP for IPSec VPN termination"B" end - Mikrotik public IP for IPSec VPN termination IPSec Tunnel not work. The police 1 phase is accepted. But what this?2019-05-16 14:31:43.017 +020...

remote vpn on iphone and android config?

i successfully configured remote vpn client for windows to function but the customer is asking for vpn using mobile phones? would it work with the exist configuration? or does it need other kind of configuration? does the mobile phone pull the client from the palo alto as well?

SSL Expired Cert and SSL decryption

We have vendor site which we access.Recently their SSL cert expired and when I try to access that website chrome shows cert is invalid and still in brower it showsit is decrypting the website and i can see the PA cert there. Traffic log shows isession end reason was policy deny? Why PA shows cert as invalid or non trusted when vendor ssl cert is...

Discussions

VPN client to site don't much the local dns register

500 INTERNAL SERVER ERROR