General Topics

Resolved! userid in multiple VSYS environment

Hello, We are using PA cluster in multiple VSYS environment. We would like to be able to configure user / group based policies across all the VSYS by sharing userid mapping table with all the VSYS (the user identification baseline is the same for all the VSYS). Is there a quick method to achieve this or do we have to configure (same) userid sett...

Resolved! Troubleshooting Application Incomplete with two way TCP traffic

We are having issues with one application while migrating the network from ASA to PAPA is Running 8.0.9 on 3020. Application shows as incomplete with more than 4 packets.We see trasmit and receive in the PA.Nothing in threat logs. As per TAC they say use App override as first step and then flow basic and content basic.Will do this once gets test...

Resolved! Phase 1 is down but phase 2 is up- test vpn phase 1 and 2

we have tunnel from PA to vendor which is using Cisco ASA.When there is no interesting traffic tunnel is down by design this part is ok. but today i saw phase 1 as red and phase 2 as green on gui.I did the test vpn ike command and phase 1 was greenbut i was unable to ping across tunnel i see traffic going via tunnel but no replies. Then i did ...

PA-VM not recognizing SSL and denying traffic

Hello, We are implementing SSL Decryption to PA. Because of this forcepoint agent (that is installed on theworkstation), the return traffic from the Internet (ie: facebook.com, etc) will be denied by the firewall as the SSL certificate has been changed by forcepoint and it is considered untrusted by the firewall. Do you have any recommendation f...

Resolved! Does PA global protect gateway support remote access vpn without GP client

Need to know if PA Global protect can support 3rd Party Remote access vpn?For example remote access vpn from modems using ipsec? We need to support remote access vpn for some clients where the end user will not have the GP client installed on their enddevices.

Resolved! Error Message in PANGPA logs

Hello, We are using 4.1.0-98. The clients at fault work fine through a tethered mobile, however when connecting to their home WiFi the connection is successful but nothing will work through the VPN. Below is a log snippet. What exactly is going on here? <error>Gateway Default: Checking network availability and restoring VPN connection when...

Critical System Alert

The firewall has flooded the system logs with the following message:Traffic and logging are resumed since traffic-stop-on-logdb-full feature has been disabled. Software Version- 8.0.3-h4Model: PA-3020 Disk space looks fine: Filesystem Size Used Avail Use% Mounted on/dev/sda2 3.8G 2.7G 897M 76% //dev/sda5 7....

Incorrect User-ID

Hi all, I'm having an odd issue. I have global protect configured and using Okta (saml) authentication. Now everything is working fine except that a handful of users have the wrong user-id. All users are expected to have their email address as their user-id however that handful of users for some reason has the format of "domain\username" inst...

Resolved! Identical Rules on 2 Firewalls

Hello Is there a way in which I can see which security rules are identical on 2 Palo Alto Firewalls? Probably with Migration Tool or something? BR,RJ

Resolved! Feature Request: Preference Option to Restrict Zones/Objects to Only Existing When Building Policies

The current PAN-OS GUI makes adding objects and zones on the fly very easy while building policies.Unfortunately this sometimes casues unwanted side effects:As an example, when building a security policy including the zone "Admin" I started typing "admin" in the zone add field as a search and pressed enter. Instead of choosing the already-built ...

Resolved! PanOS 8.1.5 No SNMP ifInOctets/ifOutOctets

We recently upgraded our firewall to version 8.1.5 and noticed that SNMP data traffic monitoring stopped working. If we get de SNMP values, we receive this informations: IF-MIB::ifIndex.9 = INTEGER: 9 IF-MIB::ifDescr.9 = STRING: ethernet1/4 IF-MIB::ifType.9 = INTEGER: ethernetCsmacd(6) IF-MIB::ifMtu.9 = INTEGER: 1500 IF-MIB::ifSpeed.9 = Gauge32...

Resolved! DNS is changing?

Anybody has hear about it and are PA firewalls effected by it. It seems they are making some changes to its functioning. Does PA application supports the said change? https://dnsflagday.net______________________________ What is happening? The current DNS is unnecessarily slow and suffers from inability to deploy new features. To remediate these...

GP+DECRYPT+MFA

Hello, I have been playing around with this setup: - user connect to internal network with globalprotect- initiating any connection to internal resources trigger ether a redirect to captive portal for MFA challenge or a global protect popup with the captive portal URL for MFA challenge. This seem to work as expected, but I have encounter a show-...

Resolved! Application changed color in ACC.

Hello, I changed a timeout value on an application and then changed it back to original setting, after this: The application show up in a greenish color (like the support info button color) in ACCThe application lost its category and sub-category. Both show up as unknown. Anyone else experience this? Bug?

Resolved! rule any any with no security profile

need to confirm if i use rule with any any and no security profile does it do any layer 7 inspection? is this same as app override?

Discussions

Resolved! userid in multiple VSYS environment

Resolved! Troubleshooting Application Incomplete with two way TCP traffic

Resolved! Phase 1 is down but phase 2 is up- test vpn phase 1 and 2

PA-VM not recognizing SSL and denying traffic