General Topics

Discussions

Sorted by:

Discover LIVEcommunity Through Our New Animated Explainer Video!

We’re thrilled to unveil a brand-new animated video that highlights everything LIVEcommunity has to offer!

This short and engaging video gives you a quick tour of the many resources available in our vibrant community — from interactive discussi

...

Fuel User Group is Now Part of LIVEcommunity – Connect & Learn for Free

Hey Everyone!

The Fuel User Group is now part of LIVEcommunity! If you haven’t come across Fuel before, it’s a space where you can connect with fellow cybersecurity folk, share knowledge, and learn from each other. It’s completely free as well! Fue

...

Welcome to the General Topics Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating:

Rules and Best Practices

Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussion

...

Resolved! Partial Import of Address-Groups results in "Unexpected Here"

Anyone seen this before? currently testing in Panorama on version 7.1.5 and trying to import Address Groups. Addresses works fine and are present.

command being run is:

load config partial from test.xml from-xpath shared/address to-xpath /config/share

...

Resolved! Query on HA1 link

Hello,

We have an Active-Passive setup. The HA1 link in the Active unit shows down (red) if the Link settings are set to auto/auto.

If I change the settings to 100mb link, full duplex and link state to up, the port shows up (green).

Shouldn't it work i

...

Authenticating with Captive Portal

I just got off the phone with technical support and the technician said that the only traffic I can authenticate is http/https. Can someone confirm that the use case below is not valid?

Here is what I want to do:

Use HTTPS to authenticate a user

...

Exclude account(s) from authentication?

I know there is the allow list, but what about an exclude? We use Captive Portal for BYOD and have thousands of accounts we want to allow, but exclude our double digit generic accounts from being able to log in. What's the best way to achieve this?

QOS bypass traffic

is there any way to get more info about what kinds of traffic are being classified as "bypass" traffic?

i have not found anything in cli, traffic logs or acc.

Resolved! User ID mapping when switching between wired and wireless

A lot of my users login into their computers using the wired connection. Then when they are off to meetings, they switch to wireless (without logging out and logging back in). If I turn off client probing, this creates an issue where they switch to

...

Resolved! FQDN cache limitations

I wanted to reach out tot he community and see how people are handling FQDN cache limit issues.

Example:

* Internal DNS caches up to 8 IPs for each FQDN

* PAN device will cache up to 10 (source: https://knowledgebase.paloaltonetworks.com/KCSArticleDet

...

Multicast configuration for IPTV

Hi all,

I'm lost configuring my PA-500 for IPTV using multicast.

My provider has a new option for IPTV.

They stated that in order to test the configuration one should try to open:

https://www.fiber7.ch/documents/129/Big_Buck_Bunny_Stream.xspf

So fa

...

Resolved! Connecting PA820 to Cisco ASA HA

Hi All,

I want to connect PA820 to ASA HA setup. ASA1 and ASA2 need to connect to PA820. Can I use link aggregation on PA820 for this scenario? If one of the ASAs fails will this setup work to pass on the traffic using the other ASA.

Thank you.

Resolved! GlobalProtect VPN "Always On"

Hello,

We are currently migrating from Cisco AnyConnect to a GlobalProtect solution that is hosted on an Azure cloud VM and really like the "Always On" feature. The only set back we have noticed is there is no way to manipulate it to only connect whe

...

file blocking profile but allow some apps

We have recently enabled file blocking on all our web access rule and it works a treat, but looking at the data filtering logs i can see the likes of Google Chrome being blocked.

I have played around creating a seperate rule, that is above the ma

...

LSVPN Satellite Reconnection Time

Does anyone know how to decrease the time between LSVPN Satellite connection attempts?

If one of our satellites drops off (e.g. reboot/power outage/etc), after it comes back up it will take up to an hour to connect to it's nominated Gateway. Also, if

...

EDL- Predefined Paloalto IP Lists do not update

Hi guys,

my PA is still with the initial set of roughly 500 IPs in the two predefined IP lists which do not update; it is said those lists are part of the AV signature updates which run well. I also have confirmed with the CLI that its is not a GUI p

...

Resolved! Getting error when committing more NAT rules "Total NAT DIPP rules 401 exceeds the capacity of 400"

https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/networking/nat/nat-rule-capacities

describes the NAT Rule capacities as follows:

-----

The number of NAT rules allowed is based on the firewall model. Individual rule limits are set for static, D

...

Panorama templates for an Active/Passive setup?

I'm in the process of setting up our new firewalls. I went ahead and set up management on each of them, got them updated, got them paired up into Active/Passive, and am now following the Palo Alto 8.1 guide to migrate an HA config over to Panorama.

...

User

Count

Subject

Likes

Likes Count

7 Likes

6 Likes

5 Likes

3 Likes

General Topics

Discussions

Discover LIVEcommunity Through Our New Animated Explainer Video!

Fuel User Group is Now Part of LIVEcommunity – Connect & Learn for Free