This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
General Topics
Post a discussion here if you have general questions regarding configuration and troubleshooting for Palo Alto Networks products. Use this forum to collaborate with like-minded security professionals to improve your security posture.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
General Topics
Post a discussion here if you have general questions regarding configuration and troubleshooting for Palo Alto Networks products. Use this forum to collaborate with like-minded security professionals to improve your security posture.
About General Topics
Post a discussion here if you have general questions regarding configuration and troubleshooting for Palo Alto Networks products. Use this forum to collaborate with like-minded security professionals to improve your security posture.

Discussions

Start a conversation

Port Translation very slow

Hello, We setup a inbound NAT to direct port 443 to a server on-site on 10.x.x.x and it all worked fine and fast - then it turned out we needed to adjust it to port 4443 as the customer was using port 443 for inbound client VPN connections of course. Anyway, after I adjusted the NAT inbound for this one rule (a simple change of 443 to 4443) - th...

URL blocked - Application "incomplete" and Flag 0x400019 in traffig log

Hello, everybody! I have a problem with a URL that is being blocked despite being explicitly allowed in the white list. I have seen the traffic logs and for that destination IP address (i.e. a website on the internet) I see that Application is "incomplete" and the Flag 0x400019. What does this flag mean? I only know the usual flags as listed in ...

Resolved! A few questions

Afternoon Firstly I want to say I really like this product, it has endless possibilities in improving internal security in our environment. I have a few questions I hope you can help me clarify so I understand how to use the product better. I am using a syslog miner to send syslog TRAFFIC and THREAT data to Mine Meld from my Paloalto firewal...

Resolved! Auto populate portal address global protect

We are looking at internal only with no tunnel for global protect for user-id. Is there a way to autopopulate the portal address so a user would only have to enter credentials and not enter portal address manually? Looking to push this out, and thinking users may not be aware/know of that portal address.

Sec101 by • L4 Transporter
  • 4921 Views
  • 1 replies
  • 0 Likes

Resolved! HA Link and Path Monitoring

We've configured HA Active\Passive on a pair of 5250's running PAN-OS 8.1.5 and it works a treat and pre-emption also works as expected. I've configured Link monitoring so if we get an HA failure if the trusted links fail which works and it fails over to the passive as expected but when the links come back it doesn't fail back again to the activ...

JonHill by • L1 Bithead
  • 10699 Views
  • 11 replies
  • 0 Likes

Use XML API users in policies

Hallo,I successfully configured an WLAN-Accesspoint to send users via the xml api.I can see the users in the log entries but I cannot select the users in particular policies. Looks like the users are not known to the firewall.Do I need to create local users with the same username? Or how can one use these submitted users in policies?Thank you.Re...

tsauter by • L0 Member
  • 2958 Views
  • 3 replies
  • 0 Likes

Resolved! Dedicated Logging Export Interface on PA 5220?

By default, I know that you can send all of your logging messages out the onboard management interface, on a platform like the 5220. However, I would like to avoid the extra noise on my management network, by configuring separate, dedicated interfaces to handle and offload the logging operations, to remote systems. Ideally, I would like to pair...

Static Route monitoring and NAT

I'm having an issue with my NAT policy. I've configured a backup ISP connection with a static route and a higher metric. When the primary ISP connection fails the routing portion works correctly and I can see the primary default route get removed from the routing table and the secondary kick in. However, the NAT policy is still trying to use p...

Modo2016 by • L1 Bithead
  • 3044 Views
  • 2 replies
  • 0 Likes

Change interface virtual router cause network down

My network has 2 outgoing data lines. Using one virtual router and set static default route for the 2 interfaces. The 1st interface has its Metric set to higher priority. As I want to divide the traffic. Some zones were force to use the 2nd interface by setting "Police Based Forwarding".Above settings work until I found that the 2nd interface wa...

jeremylo by • L3 Networker
  • 3952 Views
  • 3 replies
  • 0 Likes

Force to Use Certificate

Dear Friends !as i study PAN 7.0 if there is no Certificate installed in Client PC, PAN can not read https secure sitesin this is if i block youtube or other social websites and client uninstall CA from its browser he/she will be able to open blocked websitesis there any solution to configure PAN to force user to use CA Certificate, otherwise bl...

Blocked WebSites

Dear Friends ! i am using PAN 7.0 and blocked some secure websites, but PAN is not able to block websites by namefor exmaple when i access 53.55.125.73 it is blocked succesfully but when i type https://www.mydomain.com Certificate is verfying by PAN by not block, even i mentioned exctly my website in blocked catagyry like: https://www.mydomain.c...

Upgrade 3020 to new version?

Hey guys,There are two 3020s in HA that run 8.0.7I'm wondering if I can upgrade to a new version in 8.1.X train? Or should I stay at 8.0.7? Can someone share their experiences? Thank you.

MPI-AE by • L4 Transporter
  • 5884 Views
  • 10 replies
  • 0 Likes

Resolved! GlobalProtect when Palo behind ASA

Hi All I've been tasked with getting GP working and as I'm not as skilled as many of you, I thought I'd ask the brains trust if this is possible.We have a PA-3020 which sits behind a Cisco ASA. The ASA is the edge firewall and is a yes/no gateway, the PA then filters the requests based on port and destination.This config isnt changing in the sho...

  • 24396 Posts
  • 123 Subscriptions
Top Solution Authors
View All
Labels
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks