General Topics

Panorama and active/active configurations

Hi, Recently, we added more PA devices to our infrastructure and we decided to start using Panorma to manage all these devices.So far, we haven't experienced an improvement in efficiency or user/admin friendliness. Let me (try to) explain:We have two firewalls who are configured as an active/active setup. (No panorma yet).These firewalls had to ...

Certificate attached to non existant security profile

Hello, I've encoutered a problem regarding the deletion of a Certificate. When i try to delete it i get the following error message:1- Failed to delete certificate - xyz xyz cannot be deleted because of references from: ssl-tls-service-profile -> xyz-ssl-tls-service-profile -> certificateWhen i travel to the SSL/TLS Service Profile...

Custom extensions for file blocking

I've got our PA setup to block file types that are risky. But, I've found a problem with Symantec LiveUpdate pulling down the update files it needs. It uses a couple odd file types that aren't in the list as types that I can allow for a profile. Is there a way to add custom file extensions that I can use to match against, or is there another ...

Problem with GlobalProtect password.

Hello all!If we put a sterling pound (£) symbol in a user password, the authentication fails. We are using GlobalProtect 4.1.8 and use a RADIUS server running Microsoft Azure MFA server on the authentication profile of the GP gateway, with just an LDAP profile on the portal. Is this related to a GlobalProtect bug?Thanks in advance!

Resolved! Re: Pass word protected Winrar file

Can anyone throw some light on Best Practise for inspecting Password Protected Winrar/zip files on Palo's.Thanks

How to disconnect authenticated Live User from PaloAlto FIrewall

I need to know , How to forcibly disconnect authenticated Live User from GUI of the PaloAlto Firewall ?

Global Protect Client 5.0 for Windows and Mac

I'm looking at the release notes for the Global Protect client for Windows and Macs, now at 5.0.1 Am I missing something ?What is the reason for the 5.0 client?I don't see that there are any new features, or changes in behavior. Or is it simply that 4.1 is at the end of maint ? Greg

Limit download file size with specific response message

Hello Guys, I succeed limit the download file size with the following KB: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClhHCAS However currently the user is alerted with the antvirus response page. Is there a way to provide him a specific response message and not apply the antivirus one? Thanks. Best regards

Resolved! Receive ping count 0

I've allowed ping traffic from an external source to the outside interface IP.When they try to ping the firewall, I see allow traffic on the correct rule, but it only shows a send count >0 and the receive count remains 0. Also they report they do not receive the responses.How is this explained?I would expect to see a receive count to be at le...

IKEv2 Mobility and Multi-homing Protocol (RFC4555) Support

Did a quick search on this but couldn't find anything on this topic. Do any of the PAN firewalls support IKEv2 Mobility and Multi-homing Protocol (MOBIKE), specifcally RFC4555? I noticed that Cisco ASR5500 platform has support for this, so I'm curious if the PANs support this RFC. If not, are there any plans to do so?

Resolved! Global Protect Gateway communication

Does anyone have insights into how often the client will talk to the gateway if used only for user-id and not utilizing a tunnel? I know you can set the portal refresh time, but how often does the client actually talk to the gateway after grabbing credentials of the current user when logged in? I ask, because we are testing some 3rd party VPN ...

Redistribution Profiles - Source Types

Hi. I need to redistrubute some routes (loopbacks, and statics) into BGP. Are their any advantages to having the source type as static vs connected under Virtual Router - Redistrubtion Profile - then go into Redistrubution Profile - Source Type. Thanks.

Resolved! Minemeld install errors on ubuntu server 16.04 LTS (amd64 bit)

Installed minemeld on Ubuntu 16.04 LTS (AMD64bit) following https://live.paloaltonetworks.com/t5/MineMeld-Articles/Manually-install-MineMeld-on-Ubuntu-Server-16-04/ta-p/253336 Minemeld failed to start with exit code 203. Following command showing issues with the package. @lmori : please check below output. administrator@ubuntu:~$ sudo /u...

Resolved! Query on Brute Force Attack

Hello, Is it possible for the PaloAlto FireWall to stop brute force attacks for inbound SSL sessions without the inbound server certificate being installed on the PaloAlto? Is there any KB for this?

Resolved! Proxy IDs and routing

When having Site-to-Site VPN with Proxy IDs, do we still need to configure static route with next-hop the VPN tunnel interface or will traffic matching the proxy IDs be sent over the tunnel regardless of static routes?