General Topics

Feature Request: Do Not Require Machine Certs to be Imported on the Firewall

For some background: We recently impelmented a data protection strategy within our organization and would like to restrict the Global Protect remote access VPN service only to domain-joined laptops. Since all our endpoints within our environment receive a machine certificate signed by our Internal PKI Root CA, we wanted to leverage those certif...

Resolved! Export Qos Interface Statistics

Hi just wandering if you can export QOS interface statistics once you have configured your specific interface profiles.. You can view these statistics in realtime but l can only seem to export to PDF/CSV the configuration ? Unless there is another way of exporting interface throughput/bandwidth statistics over a certain period of time.. Thanks SG

Resolved! Security Policy Best Practice

Hello all,I've read multiple documents from PA and read some on the forums here, but cannot find anything definitive on this. What I'm trying to find out is what is the best practice/most effective way to configure a Security Policy for filtering. I understand there are several ways to do this, but I've found that the way I've been doing it does...

Resolved! tunnel to azure and phase 1 and 2 lifetime

when renegotiate happensorwhen lifetime expires will that cause traffic going via tunnel to be dropped? We have phase 1 and 2 lifetime set to 24 hours.

CheckPoint / Migration Tool / Panorama

I have been through the process of getting the files from CheckPoint, going through the migration tool to eliminate unused address, services, etc. I have completed the merge, generated the XML & SET files. I want to get these configuration files into Panorama so we can manage the firewall cluster from Panorama. Can someone tell me or point...

How to integrate Palo Alto Networks & Smokescreen Solution

Hi Guys, Anyone know about how to integrate with palo alto and smokescreen solution.

Resolved! Query on Log Forwarding

Hello, We would like to send traffic logs to both Panorama and OpManager (Syslog Server). How can get this configured? We followed the link below but when we go to Policy>Action to forward the log we are not able to select both Panorama and OpManager Syslog. https://docs.paloaltonetworks.com/pan-os/7-1/pan-os-web-interface-help/device/device...

Resolved! Query on URL filtering

I found this article on URL filtering.My question is how is *.baidu.com not allowing mp3.baidu.com or news.baidu.com as wellWhat does *. signify or equate to this scenario. ALso is there is any need or scenario in which we would need to add www.baidu.com*.baidu.com as rules in Custom URL category. Any Help would be appreciated. HOW TO ALLOW ONE...

Is the PA-3020 adequate for SSL Decryption (and other features)?

My company has 2 PA-3020 firewalls in Active/Passive configuration. They were purchased way before I started working here, so I had no input on the model that was selected. We have about 500 users in our network, and about 800 devices. In our environment, these firewalls sit at the perimeter edge, and there are no internal firewalls (for network...

Resolved! Custom Prototype for 'basic' weblist mining

Hi, I'm trying to create a new custom prototype to ingest a list of URL's that is hosted on a simple webserver. badman.one/1/2/3 badman.two/ badman.three/2/3/4/5.exe The list is published as above, and it works perfectly when I use as an EDL source, but I cannot ingest into MineMeld (as I want to mux it with my other lists to reduce overlap ...

Resolved! Site to Site tunnel

Hello I have a question about the configuration of the ipsec tunnel, in the article when the tunnel interface is created "Optional) If you want to assign an IPv4 address to the tunnel interface, select the IPv4 tab, and Add the IP address and network mask, for example 10.31.32.1/32." That "Optional" address, what should it be? from my network...

Resolved! WildFire phishing emails allowed instead of blocked?

Hello Everyone, I note that when I view the Monitor -> Wildfire Submissions activity on my Palo Alto PA-3020 8.1.6, all the detections with a verdict of "phishing" with a Severity of "high" are allowed. However, the other verdict I can see, which is "malicious" with a severity of "Informational" is successfully blocked. Is this the behaviour...

Minemeld processors have no indicators

I have created a new event processor and output node, but i'm not getting any of the indicators from the two nodes, and could use some assistance. @[email protected]

Resolved! troubleshooting SSL decryption

We've been using SSL decryption for a while now.Where for the most websites, this is not an issue, once in a while a user complains that certain https website doesn't load at all. Browser just keeps loading indefinitely.We can't find a reason in the logs, traffic is allowed, not blocked, decrypted flag is checked in the log detail.For now our wo...

Minemeld - New Install - Advice

Hi Mindmeld Community I wonder if you could kindly offer some 1st steps advice ? Can anyone offer any tips and quick hits I can setup to show Managment it working, Id like to show them that the threat intel we can pull down is actually being used to make changes. Many Thanks

Discussions

Feature Request: Do Not Require Machine Certs to be Imported on the Firewall