This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
General Topics
Post a discussion here if you have general questions regarding configuration and troubleshooting for Palo Alto Networks products. Use this forum to collaborate with like-minded security professionals to improve your security posture.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
General Topics
Post a discussion here if you have general questions regarding configuration and troubleshooting for Palo Alto Networks products. Use this forum to collaborate with like-minded security professionals to improve your security posture.
About General Topics
Post a discussion here if you have general questions regarding configuration and troubleshooting for Palo Alto Networks products. Use this forum to collaborate with like-minded security professionals to improve your security posture.

Discussions

Start a conversation

Resolved! Logs to both Panorama in HA

Hi We have 2 M500 in HA. Lets call them M1 = normally active and M2 = normally passive.We have PA5000 series firewall and we manage it using the Panorama. We realised that the Firewall only sends the logs to M1 which is normally OK. But when we triggered a Panorama failover and M2 active, then the FW did not send logs to M2 but it stored the lo...

MineMeld - Invalid character for PaloAlto Import and List Length

Hi All, Two questions, One:A domain list we are trying to use has the following entry "streamillimité.com"As a test I manually added the list to the Palo UTM via a Custom URL Category and ran into the error "Invalid characters found in file".I am wondering if MineMeld can remove characters before generating the list, for use via a EDL? Two:The ...

Resolved! WildFire Submissions no logs

Hi All, PA-3050 PAN-OS 7.1.6 While checking WildFire configuration l have noticed strange thing where no logs display on the WildFire Submission or Data Filtering tab: When l test with the KB article below can observe that the test file is sent to the portal and verdict is assigned: https://live.paloaltonetworks.com/t5/Management-Articles/How-t...

WildFire no Submissions logs.PNG
Portal.PNG
CLI.PNG

DNS Sink Hole not working

8.0.4 I am trying to get SinkHole to work... Not having any luck, using a dns from the release notes of 2520-3016 nslookup gefndb.com returns the real address All looks correct, just does not seem to work ----------------------------------------------------- set rulebase security rules "Rule 1" from TRUSTset rulebase security rules "Rule 1" to U...

Do I need Logging Turned on on TAP security rule?

I am implementing a tap interface to listen to our internal network traffic. I don't want all the non THREAT traffic loged, if I turn of loggin in the security rule will the threats still go to the threat log? (I am presently listening only on a very quiet interface which has generated only one "informational" alert in 24hrs. Thanks Robin

Determining if PAN might be introducing Skype video problems

Skype video calls are often described as choppy. The sysadmins who admin skype for business onlineare point the finger at the PAN 5060. It is not configured for QoS but it's only processing 600Mbpstops and typically around 400Mbps. What might be some means to rule-in, rule-out the PAN? Thank you.

Resolved! IPSec Tunnel performance tips?

Hello folks, I've seen a this article about improving performance by enabling this Adjust TCP MSS. Ours is not enabled.https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Improve-Performance-for-IPSec-Traffic/ta-p/53301 Would this be enabled on the public internet facing interface?I do see some TCP retransmission and reassembled mes...

ipsec_performance.jpg
OMatlock by • L4 Transporter
  • 5626 Views
  • 1 replies
  • 0 Likes

Determining if PAN might be introducing Skype video problems

Skype video calls are often described as choppy. The sysadmins who admin skype for business onlineare point the finger at the PAN 5060. It is not configured for QoS but it's only processing 600Mbpstops and typically around 400Mbps. What might be some means to rule-in, rule-out the PAN? Thank you.

debug Palo alto firewall rule

we maintain one PA security policy rule and give ip 192.168.0.11 to access server UTP01, the user is using ip 192.168.0.11, and he can't access the server, we can't find any security log for this. may i know how to debug this rule?

palolili by • L0 Member
  • 2851 Views
  • 2 replies
  • 0 Likes

Firewall analyzers

Can anyone let me know about their experience with firewall analyzer tools? I work at a university and we have 20 PANs, but we're expanding to new campuses in a few cities in the US and one in Italy. It's going to be tough to manage double the number of devices, but I can't find anyone with good experiences with these tools. Gartner and Forres...

Global protect timeout

Here is a peculiar situation. We have some field users who use their hotspot to connect to global protect. Sometimes,they loose internet intermittantly for couple of minutes so they are being kicked out of vpn session on their machine. But in fact firewall is still having the session running on portal/gateway. They are being required to enter t...

Source Translations

I'm trying to find out how to get all the static source translations for a perticular subnet on our Pan 7050. I'm trying to make a spreadsheet to keep up to date static ip's being used. Can do such a command cli on the Pan. I was able to do on a Cisco ASA. But still new to palo alto. Any Ideas. Thanks

Resolved! GlobalProtect Inactivity Timer - is HIP Profile required?

So in the configuration of GlobalProtect ( v8.0.5, under Network > Globalprotect > Gateways > (gateway name) > Agent tab > Timeout Settings) There's an 'inactivity logout' setting, that has a description of 'Users are logged out of GP when the gateway doesn't receive a HIP check from the GP app in the time specified'. My questio...

Resolved! SYSTEM ALERT : high : User Group count of 2358 exceededs threshold of 1000

According to the New Features Guide in 7.1 PAN-OS the User Group Capacity was increased to a max of 3,200 groups IF you are following their note below: Do not add entries to the Group Include List or Custom Group list—doing so limits the number of groups that policy rules can reference. Populated lists can have a combined maximum of only 640 gr...

bspilde by • L4 Transporter
  • 21646 Views
  • 9 replies
  • 0 Likes
  • 24428 Posts
  • 125 Subscriptions
Top Solution Authors
View All
Labels
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks