Question about Scheduled Device Config export of Azure FW from Panorama - 01005602

Hello,

Scheduled Device Config export is only exporting local running config from the managed devices(same as export config snapshot done from device) and not panorama pushed policies,objects and network templates. While this may appear as an expecte

Palo Alto Mgmt Port Issue

Dear Friends,

We are facing a issue that currently we are unable to console to firewall device. But traffic is passing through active firewall. Status is HA1 backup= Down

Please advice 

Thanks,

Lakshitha

URL Filtering block websites?

I have a URL filter profile with a list of URLs set to block (under Objects  Security Profiles > URL Filtering), which is applied to security group profile. 

However none of the URLs are being blocked. 

Is there something I should check to confirm this

URL Filtering different with browser and application

Hi

We have a server, from where the user wants to go to, for example, abc.xyz.com.

The certificate from the website xyz.com has a CN *.xyz.com.

We dont have decryption for URL Filtering. In the URL Filtering category, we have allowed abc.xyz.com.

The u

Wildfire Update failure

Hello,

On the Tasks, I found Wildfire update failures.

How can we resolve that?

FQDN as source address

Hi to all

I have a problems with riles with FQDN

For example i created rule:

source ip - destination ip - destination port

I changed ip to FQDN object - pc1.domain.com.  Palo Alto can resolve name to IP. 

New Rule:

source FGDN - destination ip - dest

Custom Vulnerability Signature Name in Panorama logs

Anyone using custom vulnerability signatures in Panorama?

Simple example.

Threat ID 41000

Name SSH-Auth-Brute-Force

Using existing signature 31914 with Time Attribute to block source IP if too many login attempts in specified time period.

My issue is t

Carve public Subnet without involving Vendor

Anyway to accomplish following without modifying routes at the router?

I have a subnet 1.1.1.0/24

1.1.1.1/24 PAN ETH1 Need to route 1.1.1.50 from ETH1 -> ETH3 as it sits behind ETH3. I need ETH1 to reply back to router when it says arp who has for 1.

User lockouts in STS (external authentication service)

We are experiencing a high number of user lockouts with our externally accessible STS.

The traffic is HTTPS so it is making it through our blocking policies.

We are requiring MFA through DUO but the challenge/response for the username/password is hap