General Topics

Fuel Workshop - Watch Now: Managing Your Palo Alto Networks Assets and User Accounts

In case you missed it, check out this new Fuel Workshop series, which covers the following topics:

Customer Support Portal Overview
License Management
RMA Best Practices

Dive into the three-part Fuel Workshop video series and learn how to efficient

...

Ensuring a Safe and Secure Community: How You Can Help

Dear LIVEcommunity Members,

Ensuring a top-tier experience on LIVEcommunity and protecting our members’ safety and security is our top priority! To this end, we have implemented additional security measures to safeguard our vibrant global commun

...

Introducing the LIVEcommunity Support FAQ: Your Valuable Customer Resource

LIVEcommunity is thrilled to introduce its new Support FAQ section, designed to help Palo Alto Networks customers quickly resolve their common queries.

You'll find this new area under the Articles section of the main menu:

Our goal is simple:

...

SSL CSR SAN Multiple Uses

PA-5220, 8.0

I need to generate a CSR for a cert that will be used for multiple things - web gui admin, globalprotect vpn, etc. The instructions for how to gen the CSR with subject alternative names are not clear.

Should the common name be one of the

...

Region making autocommit fail

Does anyone know of a issue with configuring regions in security policies causing the autocommit to fail?

How to easily switch between multiple GlobalProtect VPN profiles???

Forgive me if this question has been asked before. My searches did not turn up any useful items in the discussion groups. I work for a company who supports multiple customers that use the GlobalProtect VPN. As an end-user, changing from one VPN po

...

Resolved! nat before vpn tunnel use case question

Hello I am looking to understand if what I am trying to accomplish will work. Given a PAN connecting to an ASA using a L2L IPSec VPN Tunnel to access two distinct ip addresses behind the ASA. Now these IP Addresses are duplicated on the LAN the PAN c

...

Panorama 8.0.7, Losing Templates following Import Device Configuration to Panorama

Experiencing some rather odd behaviour when Importing Device Configuration to Panorama

In short what I'm witnessing is the loss of Templates (Device + Network), as soon as import is completed. The result is same whether I check the Import Shared Obje

...

Resolved! Advertise NAT Pool via BGP

Hi,

I need to advertise a NAT pool to an external partry via BGP. When i attmpt to configure the static route with as below.

I get the error message when attemping to save the virtual route configuration.

What is the correct way to configure a st

...

How to Enable WildFire to block jar file with 'malicious' Verdict

Hello Everyone,

New to Palo Alto firewalls and new to this forum.

Can I please ask how I go about changing the Wildfire action on a jar file to block? The action for this file has been to allow the file, despite the file being flagged as "malicious,

...

Resolved! About last 30days query.

Hello

Here is a qurery about last 30days.

I just would like to change started date/time automatically when Minemeld do the query.

{"operator":"all","children":[{"field":"sample.malware","operator":"is","value":1},{"operator":"all","children":[{"f

...

Url Filtering for all subdomains except one specific one

Hello,

Is it possible to block all subdomains, except for one specific subdomain, via URL filtering?

For example block *.yahoo.com, but allow sports.yahoo.com

Thanks in Advance for any advice.

Cybersecurity Thoughts

Hi,

I have recently read many Plao Alto and TrendMicro research articles, predictions and reports on subject of cybersecurity. Regardless of personal opinion there are possible catastrophic results that could happen in case of abuse of certain sectors

...

PA-5220s Active/Passive HA with Single VWire but multiple vSys's and Zones

Hi folks

Have pair of 5220s in Active/Passive HA. I'm reading that multiple zones cannot be used on VWire, well actually i'm finding that documentation not so clear and it could be functionality added in later releases of code.

Anyway let me try to e

...

Resolved! pa200 two interfaces in same zone

hi everyone,

we have a pa200 with three L3 interfaces currently in use:

eth 1/1 - untrust - dynamic ip

eth 1/2 - trust - 192.168.18.1/24

eth 1/3 - dmz - 10.10.10.254/24

eth 1/4 - currently unused

Now we would like to configure eth 1/4 just like eth 1/2,

...

Resolved! Latency on Internal Interface

Hello,

Using PAN-OS 8.0.7. When we ping a trusted interface, we see latency up and down. Any clues?

root@test-machine:~# ping 10.2.2.100
PING 10.2.2.100 (10.2.2.100) 56(84) bytes of data.
64 bytes from 10.2.2.100: icmp_seq=1 ttl=63 time=3.46 ms
64 bytes

...

UserID Factor Completion Time - Bad Data

We are seeing some random UserID entries being fed into our firewall that have a Factor Completion Time of "1969/12/31 19:00:00"; these always have a timeout of "0" so effectively kill the user mappings for that user.

Has anyone seen this before? We

...

Zone protection - alert only

I have been investigating zone protection and DoS protection for awhile now and I think I would have already implemented it if you could configure all the settings to alert when you begin testing.