General Topics

Matching Dynamic IP

I hope the brilliant minds here can answer my question I have a situation where I need to change NAT to translate in a specific way, I am looking at how the PA's behavior specific to how it selects IP address in a NAT pool based on the mask. Here is the setupCompany A uses a public IP within their DMZ for sake of example Class A (4.0.0.0/8) add...

Resolved! External Dynamic List & URL Filtering

Hello all, I want to use an EDL to try to whitelist a group of approved sites for users and block all other sites. In URL Filtering, I have all other categories set to block, and just allowing the EDL. However, when a user tries to go to one of those sites (for example - *.lync.com), he is getting blocked and the category is showing as internet-...

Are Multiple Virtual Routers needed for BGP peering with multiple local AS numbers?

Hi everyone, I have a situation where a location has 2 MPLS circuits. On one MPLS circuit, the local ASN is 65136. On the other, the local ASN is 7014. Is it possible to peer with both providers using the same Virtual router, or would I need to create a seperate Virtual Router for each circuit? thanks! /Evan

Resolved! GP 4.1.0 released and....

I have not seen any chatter or mention of this but I tried the 4.1.0 GP client in a lab environment yesterday. The good:* The app is redesigned and looks really nice* You can now select from/add/remove multiple gateways! The bad:* It would not connect to the VPN even after a reboot and reinstall 😕 After going back to 4.0.7 everything worked aga...

Resolved! Web server publishing error

Hi! Help, please, with an Internal Web server publication. I have a PaloAltor PA-200, PanOS 7.0.19. I have ext. Internet on Eth1/1 (L3-Untrust zone) and LAN on Eth1/2 (L3-Trust zone). In my LAN I have a Server with Web publication (WebServer), which should be accessd from outside (Internet). I`m trying to publish it. But got an error: Mismatch o...

Palo Alto not loading certain valid sites, why?

Having another issue with these things (ready to throw them out the window in all honesty). Seems as though a couple sites simply won't load when routed through a pair of HA-3020s. Of course Palo Alto support does a packet capture and sees no drops so immediately not their fault. But I know it is because I can route that specific traffic out ...

Resolved! Are Application Filters in Groups an AND or an OR?

Hi all, If there are multiple application filters in an application group, do they work with AND or OR logic? For instance, someone configured an application group which contains five filters. All of the filters have "Subcategory = file-sharing." Then one filter has "Characteristic = Transfers Files," the second has "Tunnels other apps," the t...

HA Active/active vwire different location

Dear All, We want to deploy 2 firewall PAN in 2 different location (Building) but same area/complex. Is there any ideal distance for HA link for both firewall? Is it need to directly or i can use via switch? Can i deploy this topology? is there any suggest?

Resolved! 2593-3089 (04/27/18 -AV version won't install on secondary

Version 2593-3089 (04/27/18 shows downloaded but not installed and when I choose install nothing happens

Resolved! Traffic showing from wrong zone

Hello all, I have a (hopefully) simple problem I can't seem to figure out.I have recently created a new DMZ zone on my PA for guest users, but when a guest tries to access the internet, the traffic is showing as sourcing from the trust zone instead of the DMZ zone. A trace from the guest user makes it to the PA, then dies. I have the policy from...

Resolved! Windows and User-Mappings

I have a user group in Active Directory where we place users who should not reach the internet. This user group is then tied to a Palo Alto rule to Deny access.I've noticed (Windows PC) this week, that if a user who is in the Deny group logs in to a PC, they will be denied (works fine), however, lets say they log out and a person who should have...

Response Page: GlobalProtect Portal Login Page

greetings! up until panos 8.0.7, i could reference logos and background pictures for my custom portal login page on secondary https servers. the web client would load them and display them. now with panos 8.0.8, these externally hosted pictures do not get displayed by the client due to newly set http headers named "content security policy" et al...

Resolved! DNSproxy resolve fail msgs - only I am not using this feature!

I'm getting system log errors that state " failed to resolve domain... etc" and lists the dnsproxy as the type and resolve-fail as the event. This is all really cool - but I have NOT set DNS proxy up - ever. If I dig through the logs - I can see a time where "Dnsproxy object:mgmt-obj was enabled" - however I do not know why it would state so as ...

Resolved! Captive Portal is not presented for wireless users

Hello All, PA3020PAN-OS 7.1.4-h2 Having a strange issue with Captive Portal on PA3020 where the captive portal just suddenly has stopped working. Did a management server restart, tested with the PC directly connected into the Guest-VLAN over the wire received a CP page and was able to surf the internet. Same VLAN on the other location (differen...

Global protect portal redirect to https

Hi, We have a Palo alto in which if you try to access to the global protect portal using http, its automactically redirected to https.For example: if we access to http://vpn.xxx.com , the browser redirects to https://vpn.xxx.com. So thats perfect. But we have another PA with another GP Portal (https://vpn.yyy.com, in which is not redirected to h...

Discussions

Matching Dynamic IP

Resolved! External Dynamic List & URL Filtering