General Topics

Best practice for applying list of IP's to a security policy.

Hello,

I'm trying to identify what the best way of applying a list of datacenter IPs to one of our security policies.  The list has about 150 IP's and I'm apparently unable to paste the list of IP's into an address group as it gives me an error notic

Non-reordered IoC feed

I have an IP IoC feed that I would like to ingest and re-publish via MM.

The feed is ordered by priority i.e. earlier addresses are newer\more active\higher risk, but if I ingest and publish (miner -> output) it is re-ordered by numeric order.  Is

Using Minemeld to mine Adobe Creative Cloud addresses?

I saw this link where someone was looking at this same type of thing I am trying to do but I have not seen someone actually create the miners for Minemeld w/ Adobe. I am looking at their GitHub on how to create a miner for them myself, but I figured

Decrypt Port Mirror problem

We have decrypt port mirrior license on our PA-850

But under interface types we can not see the Decrypt mirror type interface

The Pan-os version is 8.0.8

VPN tunnel to a firewall NOT internet facing

Hi,

I have a scenario with two sites which has two sets (HA) of firewalls, external and internal. So external handles everything internet and behind the internal the datacenter resides. Clients are in between.

We have MPLS between the sites which ter

Filtering the monitoring log fails endlessly

Pretty often seemingly simple monitor filters seem to get our PA devices in an endless loop.

For example:

( rule eq management_services ) and !( addr.dst in a.b.c.d ) and ( app eq ms-sms )

will never succeed. The fitering start running, shows a couple

Importing PA200 configuration to PA220.

We are planning to phase out PA200 firewall with PA220 .

PA200 firewall is running PAN OS 7.1.14.

PA 220 firewall comes preloaded with PAN OS version 8.0.X.

My concerns is, Can we directly import the firewall configuration  (device state) from PA200 to

URL alerting without SSL decryption

Hello all! I've got a question on URL category alerting. I can set up alerting for malware and phishing categories, for example. I get the alerts if the site is HTTP only. I don't seem to get them if it is HTTPS.

My question is this... Shouldn't the

Active/Active HA tentative state question

Let's say we have 2 firewalls in A/A HA

each firewall has 2 vWire (single interfaces, no aggregration)

eth1/eth2 = vWire 1 and eth3/eth4=vWire2

link monitoring is set such that if any of eth1/eth2 interfaces are down or any of eth3/eth4 are down the fir

Monitoring Individual Dataplane CPU's

We are currently experiencing issues in our network environment with dp0 (specifically) being overutilized on the Palo Alto 5050 and 5060's, mainly due to the fact that IPSEC traffic is not offloaded from dp0 to dp1 and/or dp2.

We can actively monito

Wired and Wi-Fi network hopping and DHCP Server default gateway route metric increases

At my remote offices, I have users that want to leave WiFi and wired on at the same time.

I have redundant PA-220's that serve as my local router and DHCP server for both wired and Wi-Fi.

The wired and wireless connections are in different networks (