General Topics

Resolved! Please suggest about mac-address control

Hi expert , I would like to know about suggest mac-control because my customer use Fortinet which use device control and I will replace and migrate to Palo-alto if that possible about control this thing . Thank you

Block "internet-communications-and-telephony" but allow Skype4Business connections

Hi community Has anyone of you already had to deal with a request to generally block the URL category "internet communications and telephony" but at the same time allow connections to Skype for Business services of other companies?The only way I can think of about this is to manually maintain an exclusion list ... Thanks for your input.Remo

Resolved! Web interface connection refused probably due to expired certificate.

Hey, The subject says it all... This is a VM-100 with latest updates. I can log in to CLI and I wonder how can I list all certificates, identify the expired cert and if possible renew it, all through CLI. Thanks for any comments and a list of my options in this situation 🙂 best regards Tor

Resolved! VPN IPSEC tunnel status is Red

Does anyboady have idea about VPN IPSEC tunnel status is Red or the reason for this??

Guide to FTPS?

One of our partners is switching it's service to FTPS, Does anyone know of a decent guide on implementing FTPS? I saw a brife article by "sdurga" but it's not very detailed. We don't presently do any SSL decryption so unsure of what we need to do and what effect it may have on other parts of the system??? Thanks Robin

TRAPS Logs 4.1.2 to panorama 8.0

Hello, I have tried push logs to panorama by KB link but I have still same error message "Connection to pan.xxx.xx:23001 failed.I am using TCP 23001 without SSLDo someone have same problem? https://www.paloaltonetworks.com/documentation/41/endpoint/endpoint-admin-guide/reports-and-logging/forward-logs-to-panorama/enable-log-forwarding-to-panoram...

How to limit global protect for specific android/ios users?

I have an interesting scenario. We have windows users accessing global protect. I am looking to buy gateway license to enable a set of users(10) out of 400 users to use android/iphone to connect to vpn. We have IBM MaaS360 MDM installed on phone to collect mobile attributes. Is there a way I can enforce a policy to limit specific users to use m...

Tunnel Monitor

Hi Members While setting up the Tunnel monitor, what would the destination IP on the ipsec tunnel. Is it the IP of the peer? and where does the alert gets generated, within the PA system logs? Regards,

Resolved! Logging Searches

Is there a way to log or record user searches on the firewall or panorama for auditing purposes? There are a lot of information in the Monitor tab that can be potentially misused, so we'd like to record the searches in that tab. Thank you.

How can I get user to type username, password and OTP when using RSA Radius 8,1 on Global Protect ?

Hi, How can I get user to type username, password and OTP when using RSA Radius 8,1 on Global Protect ? Portal = Radius (RSA) passes -> LDAP check Thanks

Resolved! packet drops on traffic going through IPsec tunnel.

Hi,We are getting packet drops on traffic going through IPsec tunnel.We have checked ISP link but there is no drops on ISP link even no load on it. Tunnel is aslo up but getting intermittent drops on traffic goint on IPsec tunnel.We have checked both end firewall but no sucesses.Kindly help.uleThnaks & RegardPradeep Chaugule

Resolved! Custom Reports takes ages

Greetings All,I am presently running PanOS 5.0.4 on a PA-500 HA. When I try generating a custom report for "URL Log" for a period of 7 days for Top 50 grouped by Top 50 groups with the URL consisting of porn and category not equal to web-advertisements, it takes ages to generate the report i.e. approx. an hour and then when I try to export in e...

After upgrading to 8.1.1 VPN always on pre-logon->user-logon failings

Wondering if anyone else has seen this? We upgraded to 8.1.1 from 8.0.8 this morning and immediately had users reporting their VPN client prompting for credientials over and over again forever. The firewall says invalid username/password hwoever we can cerifiy this is not the case using the CLI test commands... Rolling back to 8.0.8 resolves the...

Anyone use "Expired Active Directory Password Change for Remote Users" in PAN version 8.1 and GP Ver

Hi,Anyone use "Expired Active Directory Password Change for Remote Users" in PAN version 8.1 and GP Version 4.1?https://www.paloaltonetworks.com/documentation/41/globalprotect/globalprotect-app-new-features/new-features-released-in-gp-agent-4_1/expired-active-directory-password-change-for-remote-usersDoes it work? Can you do it with LDAP or do y...

UDP log that hit any deny rule and show allow

Hello, i have a question about UDP session rule 34untrust anytrust anyapp icmp, traceroute, pingservice anyaction allow rule 214any any deny you can see allow log hit rule 214i found similar case about tcp.https://live.paloaltonetworks.com/t5/Management-Articles/Action-Configured-in-Security-Rules-and-Seen-in-Traffic-Log-is/ta-p/62785 i think ...

Discussions

Resolved! Please suggest about mac-address control

Block "internet-communications-and-telephony" but allow Skype4Business connections