This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
General Topics
Post a discussion here if you have general questions regarding configuration and troubleshooting for Palo Alto Networks products. Use this forum to collaborate with like-minded security professionals to improve your security posture.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
General Topics
Post a discussion here if you have general questions regarding configuration and troubleshooting for Palo Alto Networks products. Use this forum to collaborate with like-minded security professionals to improve your security posture.
About General Topics
Post a discussion here if you have general questions regarding configuration and troubleshooting for Palo Alto Networks products. Use this forum to collaborate with like-minded security professionals to improve your security posture.

Discussions

Start a conversation

Dual ISP with VPN

I'm working on configuring a branch office firewall with two ISPs and Site-to-Site VPN to our data center. The data center side has only 1 ISP connection I'm reviewing this article again, as I've used it in the past.https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-a-Palo-Alto-Networks-Firewall-with-Dual-ISPs/ta-p/597...

MikeC by • L3 Networker
  • 3767 Views
  • 3 replies
  • 0 Likes

DoS policy notify

Hi, We have configured a DoS policy in order to limit the connections to several internal services.So when we launch a test in order to check that the connections are being limit we dont see any logs or event reporting it.But looking in policy statistics we see that its being applied.how can we verify that the policy DoS is working???? should we...

BigPalo by • L4 Transporter
  • 11861 Views
  • 13 replies
  • 0 Likes

Comcast internet VPN disconnects

My company has not transitioned to GPCS yet and currently still uses Cisco AnyConnect. We have 10K+ remote users and 5weeks ago about 100+ users started getting random disconnects and they are all Comcast users with XB3 type modem. I wanted to ask the forum if anyone has seen this type of issue with GPCS as well ? I understand that there is a lo...

BGP config same AS different locations

Hello, We found some BGP routes with same AS we are using at our PA3020.PA3020 AS 65400 BGP route (from Cisco Router) * 172.27.0.0/20 193.242.39.6 0 65394 65390 8035 21302 65400 65316 64540 4755 4755 i Usually with Cisco routers we use the command neighbor X.X.X.X allow-as in What is the command in Palo Alto Fw ? ...

block all video streaming with palo alto PA-850??

Hello all, I want to block all video treaming with palo alto. do do following this: 1, go to Objects--> URL fitering--> add new URL fitering with name block_video. 2, in categories, I check in streaming-media and choose block. 3, I create the policy with full internet, and in action tab --> URL fitering --> Block_video. But ...

Chivas by • L2 Linker
  • 8481 Views
  • 7 replies
  • 0 Likes

Global Protect Client Bundles not installing. VM100

I am trying to install a client bundle for GP on out test VM-100 The VM has no internet connection so I downloaed the bundle from PA PanGP-4.0.6 On "device > Global Protect Client " I upload the file, which works but nothign is displayed. If i go to "Activate from file" it sees the file, and seems to activate with success. But nothign appea...

Resolved! ICMP reply from the firewall instead of endpoint destination

Hello everybody,What could cause ping to respond from a different IP?When tested from source, the response message of the ping command is successful and it's coming from the PaloAlto firewall, not from the destination IP.Where and how can I verify on the PaloAlto if this is expected or not?What setup can cause such behavior on the PaloAlto?Need ...

000000 by • L1 Bithead
  • 3972 Views
  • 2 replies
  • 0 Likes

IPs and ports allowed to a specific host destination

Hello everyone! I was wondering if anyone had any tips or knew of any free tools that I could use to easily gather the allowed IPs and ports for a specific destination IP.We have a user that would like ot know what traffic is allowed to a specific group of servers. I'm just trying to avoid manually going through the all policies...I'm new to thi...

Cannot ping server but monitor sees the ping traffic as allow

My Palo Alto PA200 e1/1 (10.10.10.1/30) is connected to router A and e1/2 (10.10.20.2/30) is connected to router B.The server 192.168.1.100/24 is behind router A (10.10.10.2) which has a static router to destination 172.16.1.0/24 with next hop 10.10.10.1.The user 172.16.1.100/24 is behind router B (10.10.20.1) which has a static router to destin...

jac101 by • L2 Linker
  • 2619 Views
  • 1 replies
  • 0 Likes

New Feature request or ?

Hi I would like to have apolicy that just logs and does nothing else - ie the packet keeps getting evaluated. some times I want to know there is packet there but not process it with that line. Can this be done already ?

Azure Site Recovery Miner - XML source into Minemeld

I'm looking to do, what I believe, would be a simple minor for Azure Site Recovery IP list. The list is located here and is in XML form. https://aka.ms/site-recovery-public-ips I have bounced around on some articles and tried to follow a few, but came up empty-handed. The Node I have setup says it was successful, but with 0 indicators. Is...

Jmarx1 by • L1 Bithead
  • 4207 Views
  • 1 replies
  • 0 Likes

Resolved! Moving Colo Datacenter

Hi folks, We got some dreaded news that our colo vendor is not renewing lease and we are now moving.We have two 3020 firewalls configured in HA. I am looking for any general comments that could help in my direction. One thought:Break HA.Take secondary firewall over to new colo datacenter.Edit secondary firewall configuration for new IPs.Make sec...

OMatlock by • L4 Transporter
  • 6891 Views
  • 7 replies
  • 1 Likes

Palo Alto against spam

helloİn the network users get many spams.We dont have any other anti-spam solution.Is it possible to stop spams by Palo Alto NGFW?

Radmin_85 by • L4 Transporter
  • 11222 Views
  • 4 replies
  • 0 Likes

Resolved! Global Protect Migration Assistance

Hello! So, we inheritted an infrastructure with a few hundred VPN users whose Global Protect clients were all deployed pointing to the IP address of the GP Portal (not an FQDN). And, of course, we are now in a position where that physical site (and its IPSpace) are going away... We've stood up a new GP portal and gateway at a new location (wit...

locampo by • L2 Linker
  • 9737 Views
  • 6 replies
  • 0 Likes

Global Protect ( Force Password, Use GoogleAuth, Client required file?)

Just stating to trial GP.... And have 3 questions. 1) I can't work out what option I need to tick to force the user to re-enter their password on connect ( Android Client in this instance. 2) Can Google Auth Be used for 2FA? I can't find a guide? 3) Can I specify a resource that must be on the device ( a file for example ) as aditional requireme...

  • 24393 Posts
  • 123 Subscriptions
Top Solution Authors
View All
Labels
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks