General Topics

Resolved! Wildcard certificate on PA firewalls

Hi Team, I'm trying to create a CSR in Panorama in order to get a wildcard certificate from our third party CA. In order platforms, I define as common name the format *.mydomain.com but in Palo Alto I'm getting an error: Failed to generate certificate and key. When I change the common name to .mydomain.com it allows me to create the CSR. I just ...

Stickied post for recommended versions?

Just wondering since this is a topic that comes up often and I actually just asked TAC about it myself, should we maybe have a stickied post on here that documents the recommended versions for each software track? I realize Palo Alto doesn't publish it anywhere but the knowledge is usually spread around among the users anyways after one or more...

User-Agnet 8.0.12-5 problem to read Windows server 2016 security event

Hello, I installed UIA 8.0.12-5 on WIN server 2008 R2 (FW PAN OS is 8.0.13). I'm throubleshooting userid login problem and it looks that log event (Event ID 4768,4769,4770,4624) are not readed by the user agent on Windows Server 2016. Connecting to WIN 2016 server I can see that Event ID 4768,4769,4770,4624 are on the security log but if I incre...

show session all filter application ssl tunnel-decap no

need to know when i run below command show session all filter application ssl tunnel-decap no it shows lot of output and app is ssl which traffic is this? is this traffic where ssl decryption is going on?

Resolved! Real time alerts for threats?

Is there such a thing with PAN? IE if the logs generate a critical alert can is there some logic to fire an email or generate a report with the relevant information?

Panorama object service search not finding objects when searching on destination port

Running Panorama 8.1.3 Having an issue that when in Panorama that when I put a destination port in the search bar, it only matches against the name. When I go to the gateway, and do the same search it will find the service objects with the detination port match. This is important as for some reason many of our service names dont have the port nu...

Resolved! How to reach VPN users via RDP

Hello, is it possible to reach connected vpn client via RDP? If yes, maybe someone could take me on right path how to do it? Sincerely Deimantas

App id “Non-syn-tcp”

I see a lot of non- syn-tcp from from few specific zone. I am sure that there is no asymmetric routing. If that has to be the case how to determine exact causing factor.Thanks

Resolved! OSPF Inbound Route Filter

Hi,I see in the admin guide that it is possible to filter the default route so that it is not learnt by the OSPF process.Is there any way of applying a more granular filter so that I can restrict the Palo Alto OSPF process to only learn 10.0.0.0/8 routes? Similiar to an inbound Cisco distribute-list?Cheers

Resolved! Qos on application and class 1 and 4

I have created qos policy for application http-video and is defined in class 1 However when i run below commandsshow session all filter application http-video qos-class 1 show session all filter application http-video qos-classs 4 I see the application http-video on both? need to know why i see the application http video in the class 4?

leaf and spine and security

Hi,In a spine and leaf ( vpc ) ,where we should place the firewall to protect the data center ? If we use layer 3 firewall all routing process will be shifted to the fw, spending huge amount on spine won't be beneficial ? Layer 3 or layer 2 recommended ?Thanks

Resolved! Global Protect - Linux Fedora , CA trusted cert error

Hi There,I'm having the same issue but not on self signed certificate and on linux ( Fedora 29) Global Protect is configured with the certificate signed by the Authorized CA.The Chain is:DigiCert Global Root CADigiCert SHA2 Secure Server CAServer certificate. It works perfect on Windows. On Linux, Fedora.I get the error Error: Gateway exgw: The ...

Resolved! qos traffic stats - regular traffic and default group

created qos for application and apply it to class 1 it is applied to the interface with 10Gig lan connection. traffic stats shows default group====regular traffic==40 --- assume does it mean that total traffic going via interface is 40? also default group traffic ==== regular traffic?? when i click on bandwidth tab on left hand side it shows ...

Global Protect Certificate

Hi I configured global protect, but when clients try to connect through the agent, they got "Gateway "name":The server certificate is invalid, please contact your IT administrator". For the configured certificates, I configured self-signed certificate as a certificate authority, and then configured Global-protect certificate signed by the create...

Change Management IPs

Hi We have Panorama managing 6 PA FWs (3 HA Clusters). We want to change the management net of Panorama and Firewalls.Now logically we will change management IP of Panorama first. Then the Firewalls will lose connectivity and probably logs will be lost. So is there any best practice guide for this process?What all should be taken into considerat...

Discussions

Resolved! Wildcard certificate on PA firewalls

Stickied post for recommended versions?

User-Agnet 8.0.12-5 problem to read Windows server 2016 security event