we maintain one PA security policy rule and give ip 192.168.0.11 to access server UTP01, the user is using ip 192.168.0.11, and he can't access the server, we can't find any security log for this. may i know how to debug this rule?
Can anyone let me know about their experience with firewall analyzer tools? I work at a university and we have 20 PANs, but we're expanding to new campuses in a few cities in the US and one in Italy. It's going to be tough to manage double the number of devices, but I can't find anyone with good experiences with these tools. Gartner and Forres...
Here is a peculiar situation. We have some field users who use their hotspot to connect to global protect. Sometimes,they loose internet intermittantly for couple of minutes so they are being kicked out of vpn session on their machine. But in fact firewall is still having the session running on portal/gateway. They are being required to enter t...
I'm trying to find out how to get all the static source translations for a perticular subnet on our Pan 7050. I'm trying to make a spreadsheet to keep up to date static ip's being used. Can do such a command cli on the Pan. I was able to do on a Cisco ASA. But still new to palo alto. Any Ideas. Thanks
So in the configuration of GlobalProtect ( v8.0.5, under Network > Globalprotect > Gateways > (gateway name) > Agent tab > Timeout Settings) There's an 'inactivity logout' setting, that has a description of 'Users are logged out of GP when the gateway doesn't receive a HIP check from the GP app in the time specified'. My questio...
According to the New Features Guide in 7.1 PAN-OS the User Group Capacity was increased to a max of 3,200 groups IF you are following their note below: Do not add entries to the Group Include List or Custom Group list—doing so limits the number of groups that policy rules can reference. Populated lists can have a combined maximum of only 640 gr...
Hi I have been asked to purchase a new PA 5250.It will potentially have 20GB throughput to the internet.i am looking at an active active setup, with Aggregate interface inside to each FW.On the Outside i have been asked to connect to 4 x ISP 5GB Bandwidth on 10GB Bearer to each ISP. (this is for resilience / redundancy)To share the traffic acros...
We have project dicision that firewall 1500 units. How to design by central management.
Hello everbody, I am most likely struggling with a NAT problem in a site to site VPN tunnel, hoping you have an idea or tip to this topic.The setup is a site to site VPN tunnel between a PAN and a Cisco ASA.There is a host (172.16.2.20) behind the PAN which should be reached through the VPN tunnel.The problem is that the service provider behind ...
Hello Please help me in this scenario There is the big "Company Site" and the other branches point to this Site, there is an MPLS connection between the branches.Our need is, the PaloAlto supports segmentation on the WAN part ? can we create a sub-interfaces in the connected interface (MPLS) at the big headquarters, and each sub-interface commun...
Hi,What is candidate configuration and what is the purpose of candidate configuration ?What is the differnece between save candidate configuration and the save using the button on the top right corner ? What is the differnce between save candidte configuration and commitThanks
I would like to generate a SCEP request that I want to have signed by the CA on the Palo Alto firewall. I have beel looking at the documentation and asking my buddy Google, but have not found a way to do this. I am thinking this is not supported. Pleas confirm.
Hello everyone. Can anyone please tell me the steps to getting a PA-VM for GNS3? I've been doing some reading and need to practice using a virtual environment. Thanks.
Hi, this question may have been asked before, but I'm still curious what the best practice is in my situation. Here's what I need to do: a LAG (port-channel) with two 10gig interfaces is carved into mulitple subinterfaces. I'd like to cap the max bandwidth usage for one of the suninterfaces only. Apprently PAN5250 does not support QoS on subi...
GlobalProtect gateway client configuration generated. User name: bozo, Private IP: 136.176.144.x, Client version: 4.0.0-90, Device name: clownmobile, Client OS version: Microsoft Windows 10 Pro , 64-bit, VPN type: Device Level VPN. Why is the PA classifying the IP address given to the VPN session as private?
PavelK
on:
Replacement of RMA
