This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
General Topics
Post a discussion here if you have general questions regarding configuration and troubleshooting for Palo Alto Networks products. Use this forum to collaborate with like-minded security professionals to improve your security posture.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
General Topics
Post a discussion here if you have general questions regarding configuration and troubleshooting for Palo Alto Networks products. Use this forum to collaborate with like-minded security professionals to improve your security posture.
About General Topics
Post a discussion here if you have general questions regarding configuration and troubleshooting for Palo Alto Networks products. Use this forum to collaborate with like-minded security professionals to improve your security posture.

Discussions

Start a conversation

Security Policy Application

Hello everyone,I'm hoping someone can help me understand why a security policy is not applying the way I thought it should. Here's what I have: I have each of our schools configured on different DHCP scopes. I then created an Address Object using slash notation for each of those DHCP scopes on the PAN. I then created a security policy per addres...

GCSS-RT by • L2 Linker
  • 6214 Views
  • 10 replies
  • 0 Likes

Resolved! policy-deny website problem

Hey all,PA-3020 8.0.7I would like to access https://experimental-concert-research.org and I get "Secured connection failed"The traffic log allows those packets, but session end reason says "policy-deny".I have never seen this before.Can someone tell me what's the problem here?Thank you.

MPI-AE by • L4 Transporter
  • 5296 Views
  • 4 replies
  • 0 Likes

Destination nat not working.

I have security policy untrust -trust(webserver publicip) and nat policy - untrust -untrust.Wheni try to access web server public ip it is not hitting the security policy and is considering the destination in untrust zoneand denies the traffic.Pa200 7.1.10

Resolved! Enabling OCSP in mgmt profile also allows http management

PA-220, 9.0.0, AV2899-3409, Content 8127- 5316 I've enabled HTTP OCSP on the management profile attached to a loopback interface. HTTP and HTTPS are NOT enabled under Administrative Management Services (in fact, none are checked). Nonetheless, the administration webpage is present and can be logged into with plaintext http connections. Disabl...

bperez1 by • L0 Member
  • 3244 Views
  • 2 replies
  • 0 Likes

Default Application ID change in 8.0?

We are migrating from some 200's running 7.1.x code to 220's running 8.0.x code. We had a rule that was working fine, allowing any traffic from a server to another server. We didn't define any apps or tcp ports. We have that rule in the new firewall, but it is now being blocked as "unknown-tcp". We added a rule allowing any traffic between the s...

Split DNS

Hello We would really like to see a "split DNS" configuration for Global Protect, where you can specify certain domains that are sent to the internal DNS Server (or DNS Proxy), and all other domains get handled by the user's normal DNS servers. ThanksMichel

MichelZ by • L1 Bithead
  • 3337 Views
  • 1 replies
  • 0 Likes

Issue with WLC Radius request to NPS Server

Hi all,I have an issue with the radius request through the firewall,The radius request come from an cisco 1852-ME WLC and goes to an Windows 2016 NPS Server, both in different zones.An simular setup with an firewall works fine.The NPS Server does not react on the requests. With Wireshark I can see the request and Answer from the NPS. I suspect t...

Resolved! Running config not synchronized problem

Hey all!there are two pa 3020 with 8.0.7 in HA active passive.Three days ago, I switched the passive fw to active.Yesterday I switched back. I stated that the running config isn't synchronized, but I switched nevertheless.So I think I should "sync to peer" in the HA dashboard. But from which firewall to which firewall?

MPI-AE by • L4 Transporter
  • 20873 Views
  • 4 replies
  • 0 Likes

Resolved! Proxy Configuration

Hello, Before switching to Palo FW from Cisco one of our customers could use proxy (http://10.x.x.x/optusproxy.pac). Can you please confirm how can we set this proxy setting in Palo because couldn't find any option on GP to put proxy? I tried using it on Network > DNS Proxy. But it didn't work. Thanks in advance.

ecmp

Hi community, Does anybody clarify my following doubts about preferred path in ECMP. I am able to see * mark in one of ECMP route ?. what is that means?.I have balanced round robin, so that each new sessions should take one path alternatively right ?. then what is the relevence of preferred path. Thanks in advance.

Resolved! show deviceconfig setting url - dynamic url filtering

When i run below command show deviceconfig setting url[edit] i see no output.I read that if above output is blank then we are not doing the dynamic url filtering on the PA? Need to know should i enable this and how it can effect the performance on the PA?

MP18 by • Cyber Elite
  • 4548 Views
  • 4 replies
  • 0 Likes

Resolved! Merlin board mode?

Hello, everybody, I have come across a Palo Alto firewall that cannot normally boot up and remains in "Merlin board mode". I cannot find much information on the internet regarding this. Can someone clarify what this "Merlin board mode" is? And what is its cause? Thanks a lot!

Resolved! Route Decision in Palo Alto firewall without interface mentioned in virtual router

Hi There, Can we configure static routes in virtual router without mentioning what interface to use? Can Palo alto smart enough to identify the right interface based on the nexthop IP address? I am believing yes, could you please confirm me. especially in the case of Aggregated interfaces though, I have all AG interfaces on my PA device. Does it...

Resolved! Block Wetransfer Upload

I was doing a test on allowing wetransfer download, but not allowing upload. Ran into some issues. I have TLS decryption enabled. I have removed the *.wetransfer.com decryption exclusion. My security policy is looking for applications "wetransfer" and "amazon-cloud-drive-uploading". I have a file blocking policy that is set to block upload of an...

ce1028 by • L4 Transporter
  • 28619 Views
  • 16 replies
  • 0 Likes
  • 24413 Posts
  • 125 Subscriptions
Top Solution Authors
View All
Labels
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks