General Topics

Global Protect DHCP config

With our firewall for VPN and DHCP all we configure is under GP gateway/agent/client settings we have an IPpool and address route. We need to add DHCP option 160 and I don't believe that it can be done on the Palo. We have never setup a DHCP relay over the Managegemt interface. Just checking to see if anyone has done this and if it is the wa...

Resolved! Register new management IP address of PA to Panorama

My PA is already connected to the Panorama.I had to change the Management IP address. The PA lost connection to the Panorama.The Panorama shows the PA with old IP and status Disconnected.Is there a way to update the IP of the PA on the Panorama, or for the PA to push its new IP to the Panorama? thanks Roger

Resolved! Traffic going through Management port

Hello All, We were setting up a PaloAlto Firewall and made all the basic configuration to make a test on the production environment, however when connecting to the production environment, we could see that all the traffic from the PaloAlto firewall was going through the management port and we have already defined the routes with the interface an...

VPN Configuration Connectivity Issue

Hi, I have configured Ipsec VPN on Palo alto.But when i am trying to ping it cant reach to remote peer ip. what should i do.What should i check?

Resolved! Decryption Broker License

I can't activate the Decryption Broker License in the support portal. There is only the Decryption Port Mirror License available. Is there anything to do before? Or is there an additional subscription for this?

Panorama & "Managed Devices" unable to connect

I believe I have set up the Panorama and Firewalls correctly as per a few different KB articles I've read. I've check connectivity between the MGT interfaces, made sure that the attempts weren't being denied due to the fact that "permitted IP's" were configured. I even checked out a TCP dump of the connection on TCP 3978, and see ack's going out...

Resolved! security zones and vsys limits

I haven't been able to find a definitive answer. Is the limit of security zones per firewall global or is it per vsys.

Resolved! Getting "str returned non-string (TypeError)" for a minemeld.ft.http.HttpFT class of prototype

Hi guys, I'm dealing with a issue new to me, but perhaps somebody else has already resolved it. I built a new local IPv4 prototype based on the malwaredomainlist.ip. The configuration is: age_out: default: null sudden_death: trueattributes: confidence: 95 share_level: green type: IPv4interval: 300indicator: regex: ([0-9]{1,3}\.[0-9]{1,3}\....

Support PC which is connected via global protect.

When user is connected via global protect. How can destop support person connect to user pc who is logged in via global protect. I tried with desktop connected to global protect and then trying to access user pc who is also connected via global protect. Since users connected via global protect are in VPN zone. Allowing VPN intrazone traffic does...

policy block website because of application deafult

Dears There is policy on my firewall ,we set the service as "Application-Default" not "Any" . the problem is that when user access to specefic website ,the connection be dropped because the service is "Application-Default" although the destination port is 443 when i change "Application-Default" to "Any" ,website be opened without problem ?! I w...

Resolved! Panorama - Templates

I'm trying to figure out what the best practice and recommended method is for templates inside of Panorama? I've heard some conflicting info. Some advice says if I'm managing say 20 firewalls in Panorama, I should have a template for each firewall. I've also heard the opposite, that you only need 1 template for all firewalls. I've also heard ...

(System-Log- Alert)registered-ip-update-failure

Hi expert, I got alert on system log is critical about event type user-id on Palo alto " registered-ip-update-failure" follow as below I have wondered with the log is mean? please suggest me.

Resolved! Commit Warning: Profile compiler : app http2 not found (Module: device)

Getting this warning on several PA-820's running v8.1.2 and v8.0.9."Commit Warning: Profile compiler : app http2 not found (Module: device)" I'm not using anything called "http2" so not sure why this is popping up all of a sudden.I'm ignoring, but just wanted to post it here in case anyone else is seeing it? Commit Warning

SNMP Polling - IPSec Tunnel Status

I have downloaded the MIB's but cant find anything which would enable me to monitor the status of an IPSec tunnel. Is it possible to monitor IPSec tunnel Up/Down via SNMP?

Issues with service and applications in rules

Is or has anyone else had the problem with applications and services being ignored in rules? I have had an issue from all version from 7.0 to 8.1. I have stopped using applications in rules all together because it will not identify the application and instead mark it as "not-applicable". I have the problem with services as well. For example I wi...

Discussions

Global Protect DHCP config

Resolved! Register new management IP address of PA to Panorama

Resolved! Traffic going through Management port