General Topics

Discover LIVEcommunity Through Our New Animated Explainer Video!

We’re thrilled to unveil a brand-new animated video that highlights everything LIVEcommunity has to offer! This short and engaging video gives you a quick tour of the many resources available in our vibrant community — from interactive discussions and customer journey guides to the Cyber Elite program and Member Spotlight features. Whether ...

Resolved! Unable to export certificates EXCEPT via IE11

Two PA3020s in an active/passive HA pairPanOS 7.1.14 Tested with Google Chrome and Firefox on Linux.Tested with Google Chrome and Firefox on Windows 7. When trying to export a certificate from Device tab --> Certificate Management --> Certificates, no matter which export format I choose, nor which certificate I choose, nothing happens. Br...

Resolved! Moving between device groups

I am looking to move my firewalls from one Panorama (7.0.3) device group to a new device group. All active policy rules have been cloned over to the new device group from the existing device group, and the objects are all "shared". Even though all the rules being installed are the same, and being installed on the same set of firewalls, just ...

Resolved! show system setting ssl-decrypt certificate -----No inbound cert

show system setting ssl-decrypt certificate Certificates for GlobalSSL Decryption CERTglobal trustedssl-decryption x509 certificateversion 2cert algorithm 4valid 171204224608Z -- 221204225608Zcert pki 1subject: NGFW-2issuer: Root CA 2serial number(19)4f 00 00 00 2b e2 bd d9 f7 cb fa 0b 9a 00 01 00 O...+... ........00 00 2b ..+rsa key size 2048 b...

Resolved! Cannot retrieve indicators from FS-ISAC feed

I recently created a feed over at FS-ISAC for my organization, and I'm able to connect successfully from within MineMeld, however I am not receiving any indicators. My initial_interval is set to 30d and when I test using 'taxii-poll' from the shell I'm able to retrieve indicators that way, so I know the feed I'm publishing is working, but MineM...

Resolved! Using Same layer 3 network with different vlan tag

Need to confirm if we have layer 3 subinterface say network 11.11.1.2/24 vlan 100network 11.11.1.3/24 vlan 200 It is possible to do this on the PA?

Resolved! SSL forward trust option

Hi, We have a certificate generated by RapidSSL as CA. but we can NOT set this certificate as a forward trust certificate to use in Decyption SSL, the option shows disable. Roots is in the list "default trsuted certificate authorities". Why the option is disbled???

Resolved! JSON Parsing - ProofPoint

Has anyone been able to get ProofPoint TAP logs into MineMeld? I think the issue I'm having is with my JSON configuration. Here's what I have so far but it's not pulling any indicators. I've tested my query on http://jmespath.org/ with sucessful results. The field I'm trying to extract is the URL in the threat field - badsite.zz in the examp...

QUIC deny vs drop

Just curious. The recommended QUIC rules set the action to 'deny', but the first rule is for service udp 80/443 any application. Is there a reason this is a 'deny' and not a 'drop'? ReferenceHOW TO BLOCK QUIC PROTOCOLhttps://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClarCAC What a difference a Deny makeshttps://live.paloa...

Resolved! Allow application facebook before denying application facebook-chat

Need to block facebook chat and allow Facebook for some user group. i was reading this Allow application facebook before denying application facebook-chat Does it mean block facebook chat first then allow application facebook?

Resolved! Custom App signature and App pushed from PA update

What if we create creates a custom application containing Layer 7 signatures.And after few days the PA send the Latest APP and Threat updates and we download those in the PAWhat will happen if the update contains an application that matches the same traffic signatures as the custom application? or which thing is hit first custom app or applica...

Block VPN access for lost iphone/ipad

Hi, I followed the document on how to create VPN for IOS devices with certificates, and I got it working.I was wondering how I can deny a device VPN access for a device which is lost or stolen. Deleting the certificate Client ID certificate on the PaloAlto Box does not help. The device can still connect.The user can change his password but I wou...

LocalDB Node Bulk Uploads

Is it possible to bulk upload to the LocalDB Nodes? The input UI appears to only accept a single indicator per line, and doesn't do any validation of the information being input.

Resolved! GlobalProtect stopped to work after appliance reboot

The GlobalProtect Portal/Gateway had been working perfectly until tonight I have restarted the Palo Alto appliance.After - I was not able to connect. The portal page - ERR_CONNECTION_TIMED_OUT. I tryied to load older configs, I have even reinstalled the software version (8.0.13). No luck. I the Session Browser I do not see anything that looks li...

Resolved! PA-220 - bidirectional NAT - how to get a Nintendo Switch to work online

Greetings, I am trying to create the NAT IP only rule as outlined here.https://www.ericooi.com/palo-alto-firewall-home-network/ I have a single External WAN interface Etherenet 1/1. I am wondering how the referenced NAT SOURCE Translation interface (Object/Physical/Other???) is created to configure the Source Translation?I am only able to add '...

Resolved! About Threat and Wildfire submission

Hi all and specialist engineer, I would like to know sometimes I'm doubt about monitor wildfire submission and threat which wildfire is shown in a monitor (ref: wildfire portal ) but why threat does not show even though same both a file name and type malware.

Discussions

Discover LIVEcommunity Through Our New Animated Explainer Video!