Destination NAT is not working when PBF for dual ISP is enabled

Hi All,

I followed the guide at this URL to setup the Dual ISP for outbound access.

https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/policy/use-case-pbf-for-outbound-access-with-dual-isps

I have set the http/https services to use ISP 2

Port mirroring

Can we send decrypt traffic to more than one decrypt mirror port.whats the limitaions of using a mirror port. Does it functionality is limited if the fw is in vwire mode. Also is there a way that in decryption broker deployment model the fw doesn't h

Custom Syslog sender From Cisco WLC

We have wireless users.Cisco WLC directly sends syslog to PA.We have to parse it correctly.But after doing we get the following

We also implemented agentless AD integration.We want users authenticated through AD could connect to some internal resource

errno bad handshake, ssl routines, tls_process_server_certificate, certificate verify failed

Hello,

Several of the nodes are showing an error related to a certificate error and indicators aren't being processed. Please see the attached screenshots. The nodes were initially processing indicators so I'm not sure what changed. If you have any

Move zone and policies between VSYS

Hello,

One of our customer wants to implement VSYS. Currently, the current firewall is Checkpoint appliance (around 900 rules)..

The idea is to replicated the config from the Checkpoint to the PA with only one VSYS to avoid a big bang...

So I will crea

SSL Inbound decryption and SMTP

Hi,

does anybody have issues with ssl inbound decryption and setting the smtp decoder in AV Profile to reset-both (antivirus + wildfire)? When the firewall receives an email (with ssl/tls enc enabled) and successfully decrypt the message and found a

How to factory reset VM firewall

I was downgrading the VM 500 firewall from 8.1.1 to 8.0.10 and booted the image with wrong config file. I am able to ssh firewall but maint mode  username & password (serial #) is not working. How can I reset the password and bring VM 500 in factory

DNS query to problematic web site

PA itself was generated the DNS queue of the domain that the management interface

Why would it come up with this action, and DNS proxy do not enabled.

Please kindly advise.

 

Log:
This host was detected performing a DNS lookup for the domain en[dot]wt1[do

Redundant Interface

Is there a good way to make an AE act like an ASA redundant interface? Basically all traffic goes through one interface unless it fails, then goes to the other interface.

I'm looking for the same functionality that the ASA redundant interface provides

Always -on OTP

I have an interesting scenario where I have a firewall protecting an extremely sensitive server and some dedicated users accessing it through another zone. I ran into a situation where only couple of users need access to it when remote. I thought of

Panorama support license upgrade

Hello,

I am just trying to upgrade support license of Panorama VM from 100 devices to 1000 applying the Auth code received for PAN-SVC-BKLN-PRA-1K. It is failing with message "Failed to install licenses. An initial license cannot be applied for renewa

QoS on inter-vsys traffic

We have internet traffic and tunnels terminating on vsys1. While our servers are in vsys2. Traffic to internet or tunnels is passed through inter-vsys routing from vsys2.

Server X which earlier used to be in vsys1 and had qos applied for it tunnel tr

Inbound SSL Decryption

Hi,

I have two questions for folks

1) I have setup Inbound SSL decryption as outlined in the documentation  (Import Server Certificate, Create Decryption Policy, Create Decryption Profile), and expected that when I looked at my traffic log to the ser