General Topics

Suspicious HTTP Response Found (ID 54319) after updated to 8029-4784

Hi, Anyone else notices increase amount of Suspicious HTTP Response Found ID 54319 after installed AppID 8029-4784?. The threat vault description This signature detects a suspicious HTTP responseCategory protocol anomalyPANOS Min version 8.0.0Severity lowAction AlertFire release 785 Want to see if others are seeing the same thing on their firew...

Panorama 8.0 log retention

Hello, We recently upgraded our Panorama VM from PanOS 7.1 to PanOS 8.0, currently running 8.0.8. After the upgrade and the migration process, we noticed that our traffic log retention capacity decreased to over a third (from around 100 days to around 30 days). We had no change in our network also no reason thinking to have an increase of the ov...

Global Protect config problem: The server certificate is invalid.

Hello, we are not able to connect to one of our Gateways anymore. We get the error: The server certificate is invalid. I checked the following but this looks correct: Incorrect time settings on the firewall. Check the certificate's validation dates (valid from and valid until) to make sure the date range is correct. Check the Time Setting o...

blocking unknow tcp and udp

The 2017 Palo alto networks best practices recommends blacklisting/blocking unknow-tcp and udp, my first thought is has something changed since this article ?https://live.paloaltonetworks.com/t5/Management-Articles/Pro-Tips-Unknown-Applications/ta-p/77052 If it calls it unknown cause it doesn't have enough information to identify it, is it a goo...

Resolved! Is EDU 110 Training free?

I see that there are a few posts about similar training (EDU 101) being free, but I wanted some clarification on the other self paced training options. I'm a Palo Alto customer, and I see that I have access to "activate" a large number of training courses. Are the courses like EDU 110, 105, 121 free? I don't see anything about pricing. The last ...

Resolved! Troubleshooting GlobalProtect

PA220, 8.1.1, GPClient 4.1.1, GP license activated. Connecting to the GPportal/gateway works fine. Traffic routes as expected. We're still testing, so access is severly limited and policies wide open once connected. Literally, everything is allowed for GP users. However, when i attempt to access an internal SSL-protected site, the traffic is den...

SSLMGR certificate ocsp verification failed.Certificate status unavailble

I'm getting the following error while I can reacht the OCSP server.... SSLMGR certificate ocsp verification failed.Certificate 5200000D638821F4E9A6409C10000400000D63 status is unavailable > debug sslmgr view ocsp allCurrent time is: Fri Jun 8 08:33:33 2018Count Serial Number (HEX) Status Next Update Revocation Time ReasonIssuer Name HashOCS...

Resolved! Filter for multiple subnets

My filter is not working, can you tell me why? ((addr.src notin '172.0.0.0/8') or ( addr.src notin 10.0.0.0/8 )) and ((addr.src notin '180.0.0.0/8') or ( addr.src notin 100.0.0.0/8 ) or ( addr.src notin 200.0.0.0/8 ))or for easier reading;(NOT or NOT) and (NOT or NOT) Basically,I want to see all traffic that does not source from my int...

Resolved! MineMeld for importing STIX XML files

Hey guys, I hope you are all doing great. Its my first touch to both STIX XML files and MindMeld, so I was hoping to get a shed of light with at least if it is possible? I am trying to find a way to import manually a STIX file (which I have attached) to the MindMeld so that it can feed my VM-100 FWs, is that possible and how can I accomplish...

Resolved! can anyone direct me to the download for the user identification agent?

can anyone direct me to the download for the user identification agent?

Resolved! Cannot Ping Default Gateway

Hi Team, I am trying to set up a lab. I have configured PA and set up a client machine. But I have configured client machine and provided the IP address in the same subnet as one of PA's interface. Even after doing so, I am not able to ping default gateway which is set to one of PA's interface. Can somebody help ???????

Restrict VPN Users to certain applications

Is there a way to restrict some VPN users to only be able to access some applications (ports / servers)?

Resolved! Debug steps for multiple users dropped from Global protect VPN at same time

We had a bunch of users loose connectivity from VPN at the same time. But our BGP connections and all network connections were fine. What steps can be taken after-the-fact to verifify if the PAN 5060 in fact caused the issue?

SSL forward proxy CA cert

My enterprise has a CA root certificate pushed out to all clients. I am now planning to implement ssl decryption and want to import same cert and keys onto firewall for ssl forward proxy. what are the downsides of doing this? is it a good idea to use CA signed cert or the one I mentioned above? TIA

How to configure dynamic NAT IPs

I have a german ADSL connection and would like to make it accessible from outside. My server has internally the IP 10.0.109.111. From outside it is accessible via a DynDNS name because the public IP changes daily.My router has the 192.168.4.1 IP and the PA 200 on the eth3 has the IP 192.168.4.2. From within the Internet I can also access this IP...

Discussions

Suspicious HTTP Response Found (ID 54319) after updated to 8029-4784

Panorama 8.0 log retention

Global Protect config problem: The server certificate is invalid.