General Topics

URL Filtering category “command-and-control” missing

Hello I'd like to prepare for new category “command-and-control” I have two firewalls one with BrightCloud and one with PA url filtering database. Both with 7.1.11 PANOS and latest url filtering database but when I try to change default action for this new category I see: Do I missed something? What's wrong with my configuration could be? Rega...

Mitel Border Gateway / Teleworker

Hi all,I'm having a problem getting Mitel's Border Gateway (formerly known as Teleworker) working properly. For those not in the know... Mitel is a large VOIP phone system company and they have various addons, including a server which would typically sit in your DMZ and allow remote workers to have a handset in their home / remote location as if...

Resolved! Upgrading 7.1 to 8.0: New Log Storage

HiWe are upgrading to 8.0 and have noticed the cavet about new log storage in 8.0. We do not have log collectors setup, but are collecting logs in Panorama (threat and traffic only) and wonder if the existing log migration applies to these as well? Thanks in advance for any advice,Rebecca

Resolved! How to telnet from firewall Palo Alto to another device ?

Now i need telnet from Palo Alto firewall to another device to check connection but i can't find any command to do that.Please help me.

Resolved! URL Filtering Eval License - how to remove?

Every day we get email alerts:SYSTEM ALERT : critical : License for feature url-filtering expired on xxxx/xx/xxHow do you remove the URL Filtering evaluation license??There is no option in the GUI to remove it.I could see an option in the CLI to request a license, but not remove one.(I also don't want to remove our firewall license by mistake.)

Resolved! How to change a miner timeout

Hi all, A simple question, I hope. How do I change the default timeout for a certain miner - panos syslog miner in may case. I'd like to change the timeout to be 30 days, rather then an hour or so that seems to be set now. I could not find a way to make change through the GUI, I figure one of the config files needs editing? Thanks, Luca

Resolved! NAT rule to change internal IP to another on same subnet?

Hi folks, I have created a internal zone IP address I want to use as generic for FTP communications 192.168.1.9.I want to NAT this IP to our current FTP server 192.168.1.19. This way when our FTP server changes we just change our NAT rule rather than the rest of our partner companies firewalls, routes, etc. I've created a DNAT rule and able to ...

Script or custom report ?

Hi All I’m new in the world of Palo Alto, the guy in charge of this just left our company so I’m doing his task until someone else arrive One thing he had to do for audit purpose was to do a report for each palo Alto with Device stateHA StatusSoftware VersionApps and Threat versionAntivirus versionURL Filtering versionWildFire So he was getting...

MineMeld - debugging miner?

Is there any way to run minemeld in a debug mode that would output the command being run when a miner queries a remote source/feed?

Best way to integrate with panos?

There's ebl, edl, persistentdag, nonpersistentdag, etc. Limits on the number of feeds. Does anyone have a concise summary of some kind which makes picking which one of these, or combination of these, is the best route to go for integrating with panos?

Global VPN

Hi All, Since IOS devices has issue in global vpn due to which it cannot access the DNS define in gateway when splittunneling is enabled.Due to which user cannot access certain URL so we added them in DNS suffiex , but if we want to define the domain can enabling inherit dns suffix will resolve the issue e.g URL is abc.network..com and adc.netw...

Migrating Site to Site VPNs to IKEv2 & Suite B Crypto

Dears, I have multiple site to site VPN between my branches and most of them are terminated on PAN3020 and PAN-820.I want to upgrade them all to IKEv2 and Suite B Cryptography. What is the recommended IKE and IPSEC proposals when moving to IKEv2 and Suite B. Thanks.

Resolved! Critical License Expiration

Hi! I have a PA-VM 300, and I've got the error message "Critical License Expiration" warning.I can't seem to ping my fw interface from a directly connected host, though I have my MGT profile configured to allow ping to my internal interface. I have read somewhere that unlicensed FW can only pass the first 200 sessions, then after that it will no...

Need assistance with Certs and Firewall

I has been years since I have done anything with Microsoft CA so I am really struggling. Here is the problem: When enabling URL filtering and I am blocking a certain site that has HTTP and HTTPS, the HTTP page will present the block page, but the HTTPS does not. I am not doing any SSL Decrypt, I want to in the future but that is requiring cert...

Resolved! Certificate expired

Hello, Received following message/alert.WarningsCertificate PA Net Root CA in shared expired on Jun 3 23:26:00 2016 GMTCertificate GlobalProtect in shared expired on Jul 27 02:34:06 2016 GMTDo we need to action any renewal? If so, kindly show the steps. TIA

Discussions

URL Filtering category “command-and-control” missing

Mitel Border Gateway / Teleworker

Resolved! Upgrading 7.1 to 8.0: New Log Storage

Resolved! How to telnet from firewall Palo Alto to another device ?