General Topics

Global protect with loopback ip address and port number

Hello allWe have one public IP address and two groups of users who must connect to Head Office but get different policiesWe decide to use loopback ip address and NAT it to the public one but with different port (for example loopback ip 1.1.1.1 and public ip is 85.10.10.1 and we NATed 85.10.10.1:446 to 1.1.1.1:443)but when client try to connect t...

How does an end-user collect logs from GlobalProtect agent when the advanced view is disabled

I want to collect log files from a GlobalProtect agent 4.1.2 but our gateway policy is set to disable the admin view.By doing this, the user can't colelct any log files anymore. Is there another way to collect logs ?

Is it secure ?

Hello allWe have configured GP REMOTE ACCESS VPN with OTP authentication.Ones we try to connect to Portal it failed to pass at the first time only second time.In Radius server we see that it tries to authenticate first the Ldap account then VPN accountwe configured the followings and it is ok.And i would like to know is it best practice from se...

Resolved! ha syn failure - url filtering

on passive PA we are seeing ( description contains 'No synching file to peer because local state is not Active (Passive).' ) is this normal?

Cannot Sync Running Config in HA active/passive

Hi All, I have a PA3020 with 7.0.5-h2 PAN-os version.I have tried different times to sync manually the running config on passive member without success. I can clearly see from the Active Member's "ha_agent.log" these errors:=========================(active)> tail mp-log ha_agent.log00000001TLV[2]: type 11 (SYSD_PEER_DOWN); len 4; value:000000...

Resolved! MineMeld and Office 365

I've used MineMeld in the past and I've been very happy with all of it's functions. Recently, I've started a new job and I've recommended MineMeld as a solution to get O365 IP's into the firewall for writing policy. Microsoft announced on April 2nd that it will be retiring the HTML/XML/RSS feed. I've included the announcement and link below. ...

Resolved! Changing Firewall Rule Names (Security Policies)

I need to rename a whole bunch of firewall rules (Security Policies).Ive done a search here and looked in the manual; I think I know the answer.I can change Firewall / NAT rule names as needed? There will be nothing else I have to change right? This will not break anything? I do not think firewall names and NAT rule names are referenced anyplace...

Block page when searching google with safesearch enabled

Hello, We've recently enabled safe search on our PA-3020 and noticed that whenever you do your first google search while on google.com a quick block page pops up and almost immediately goes away. Is this to be expected behavior when safe search is enabled? Thanks

Resolved! 8.1.4 & TLS 1.3?

This link (https://www.ietf.org/mail-archive/web/tls/current/msg27066.html) says that PAN-OS 8.1.4, PAN-OS 8.0.14, and PAN-OS 7.1.21 will fix a TLS issue. I don't see any mention of this in the 8.1.4 addressed issues page though. Do we know this is fixed for sure?

Question about Scheduled Device Config export of Azure FW from Panorama - 01005602

Hello, Scheduled Device Config export is only exporting local running config from the managed devices(same as export config snapshot done from device) and not panorama pushed policies,objects and network templates. While this may appear as an expected behavior per below docs* https://www.paloaltonetworks.com/documentation/80/pan-os/web-interface...

Resolved! Dual ISP VPN failover with static route path monitor

Now that we have newer features like static route path-monitoring, is there a new recommended configuration for Dual ISP with VPN failover? I'm thinking SiteA (Dual ISP) to SiteB (Dual ISP) with IPsec VPN both using a single VR. I assume it will be one static default route with path-monitoring to fail over to the other ISP default route. Then ...

Palo Alto Mgmt Port Issue

Dear Friends, We are facing a issue that currently we are unable to console to firewall device. But traffic is passing through active firewall. Status is HA1 backup= Down Please advice Thanks,Lakshitha

Resolved! logs for Intelligence Sharing and telemetry

is there any way i can find from cli or from web gui that confirms my PA is sending all telemetry data ? any where in PA cli i can find the logs or data send to Telemetry? where it send this data to? is this function performed by the MP of the PA?

URL Filtering block websites?

I have a URL filter profile with a list of URLs set to block (under Objects Security Profiles > URL Filtering), which is applied to security group profile. However none of the URLs are being blocked. Is there something I should check to confirm this is setup right?

URL Filtering different with browser and application

Hi We have a server, from where the user wants to go to, for example, abc.xyz.com.The certificate from the website xyz.com has a CN *.xyz.com. We dont have decryption for URL Filtering. In the URL Filtering category, we have allowed abc.xyz.com.The user on the server wants to use an application which initiates a connection to abc.xyz.com.Now,Whe...

Discussions

Global protect with loopback ip address and port number

How does an end-user collect logs from GlobalProtect agent when the advanced view is disabled