PA Best practice says you should have your rules documented on the rules and some where other than your rule base. Anyone doing that? and if so how
Is there anyway to find out when a device was last shutdown? Thanks,
Hi,I have a strange scenario here. To summarize, I had previously configured GlobalProtect on a Palo firewall and configured the Palo to redistribute that network range on the tunnel interface into OSPF. This worked without any problem. Now, the IP address range for GlobalProtect users needed to change so I had to go and change the IP pool for G...
Hi,we have to build monthly PDF reports with nice graphs like Pie&Line Charts for the management. Unfortunately PDF summary reports are the only one which contain graphs (despite the ACC Widgets) and are generated only everyday. Is it possible to generate them monthly? Best Regards Juergen
I have two firewalls previously on HA (Active-Passive mode). We had to shutdown the passive device due to some troubleshooting. Then we had to roll-back the config of the active PA. Here's the current setup. (HA links not yet cabled)Active PA - lower config version (e.g. version 207)Backup PA - higher config version (e.g. version 210) If I conne...
We have an agentless User-ID setup. Firewall is able to pull user accounts from the AD.User-ID based policies were created on top of IP-Based policies. However, some user traffic can be seen using the user-id based policies, some users can be seen using the IP-based policies.This happens on all of my sites. Is this a normal behavior? Or is there...
Hi, so I've configured a new L3 subinterface on an existing L3 interface, both with IP addresses and I thought it was going to work. I've got a PBR rule in place on the previous hop, a HP switch, which diverts some traffic to this new subinterface. I can see the selected traffic allowed out from the Palo's traffic monitor logs but, from the clie...
could anyone please advise a good way via cli to debug certificate authentication. I have followed most of the log files but cannot find one related to GP authentication. many thanks in advance...
Hi All, Does anyone has any idea on how to list just the name of device groups in panorama using the api if i do the following path: https://mypanorama/api/?type=config&action=get&key=<my key>/config/devices/entry[@name='localhost.localdomain']/device-group it lists the complete configuraiton of all the device groups. thanks for a...
Hi Palo Alto Community I wanted to ask what are the pro's and cons of not using a Panorama for managing a single pair of VM-300 firewalls. From reading documentations etc, the main benefit of Panorama would only be if this was a distrbuted deployment managing 10's or 100's of firewalls. If in this case it was only 2 VM's to be managed a Panorama...
Hello Team, I am wondering how exactly the Inbound Inspection with PFS works? Diffie-Hellman per definition has the functionality that a key agreement is happening without transfering the key through the "unsecure" channel. All passively listening instances are not able to determine (calculate) the key used for the encryption. Well with this inf...
Any plan from Palo Alto to create a new URL filter category for Crypto mining ?
I am running Global Protect 4.0.3 and everthing is wokring successfully with Windows Devices. When DNS requests are made for the seach domain "foobar.com" they are directed at the internal DNS Servers defined within the GP Client Configuration and the requests are sent down the tunnel to internal DNS Servers. If it is for any other domain lookup...
I assume there is no report to list address objects that have not been used Ones that may or may not be in rules, relate to long dead or incorrectly entered endpoints, that have not generated any traffic. I have seen the "Shared_dup_and_unused... script, but don't think that gives me the desired result. Unless someone has something already, I th...
Hi So do I have to setup policy rules to allow OSPF, I have OSPF on the PA . But when i don't have the rules in place OSPF fails, when i have them it doesn't log anything DHCP, do I need it if the PA is running DHCP. what is the source and destination ? DHCP-relay, source is the input zone and the destination is the dhcp server I am relaying to...
TomYoung
on:
FWs no longer forwarding logs to Panorama
TomYoung
on:
Device Security license
