General Topics

SSL Decryption for Chrome Browser

Hello, Below is our Decryption Policy. Using latest Chrome version.Security certificate used by the Palo is from the Windows domain PKI and is already implicitly trusted as this testing is from a domain connected Windows 10 device over Ethernet.It is working fine for IE but in Chrome it is showing like this: If I set the URL Category of Compu...

Resolved! Query on GP client password

Hello, Is there a way for the Global Protect Client on Windows machines to not save the client password between session? Thanks in advance.

Resolved! Not licensed for vsys id 2

Anyone run into this one? I have a TAC case open as well.Receiving the following error on a 3060 cluster when trying to add a 2nd vsys. This is not being created on panorama, this is directly on FW01. PAN-OS-7.1.10 Error: vsys2 'vsys2' is invalid. Not licensed for vsys id 2

Resolved! RIYADH

HELLO EVERYONE !! I GOT GENERAL QUESTION ABOUT ACC RISK FACTORIT REACHES 4.0DOES THIS WILL MAKE THE PALOALTO GO SLOW ? AND WHAT IS BEST VERIFIED APPLICATION THAT I SHOULD ADDSO IT CAN LOWER THE RISK . IF YOU HAVE A LIST THAT WOULD BE HELPFUL THANK YOU 🙂

Security policy zones after a source NAT

Hi, I'm migrating my security policy from a netscreen firewall to a Palo Alto firewall. I used the migration tool and I'm currently reviewing the NAT rules, and I'm getting a bit confused about security zones after NAT. - I have 3 interfaces : Trust, Unstrust, DMZ.- I have a public IP range, that has nothing to do with the Untrust interface. My...

Resolved! Example IP and port translation rule?

Hi Folks, Trying to learn a basic port translation example to relate to some work I have, but not working for me so far. I have a basic IIS web server listening on port 80. My security and NAT rule works fine for that.Now, I change my IIS web site to listen on port 8080 (website binding) and change my NAT rule to this below, but does not resolv...

wireless intemittent Router connectivity issue

Hi everyone,I have got an Huawei HG8245 wireless router with 40 mbps optical connection on it and as we are in the same room as of the wireless router itself we are connected through wifi and the issue is that when i ping to the Ip address given to the router i.e., the Default gateway there is a intermittent connectivity issue once the packets a...

Resolved! Unable To Connect To MineMeld Output URL Via EDL

Setup an EDL in Panorama to grab a IPv4 feed from a Minemeld (Autofocus hosted) output. Verified the EDL was pushed down to one of our PA-5050's and clicked on 'Import Now' from the 5050. EDL is not able to connect and system log shows following: "Unable to fetch external dynamic list. HTTP response code said error Using old copy for refresh."...

Resolved! PDB-PAN Debugger

Well Team, Hit a keyboard shortcut earlier by accident and this populated. Can't find anything on the web about it or community. Know there was another way to debug the gui , https://[ip]/debug but never seen this. Took a picture and can't replicate what ever shortcut populated it 🙂 PAN-OS 8.0.3-h3 -> happened on a VM-200. Is it a new fea...

pa-3020 with 3ISP, how to utilize all ISP Bandwidth effectively

I configured the PA-3020 with 3 ISP as below1. ISP1-2Mbps DIA2. ISP2-20Mbps DIA3. ISP3-200Mbps DSL I want to configure the PA as below ISP1 for VPN accessISP2 for Business applications traffic with QoS (like outlook traffic and etc.)ISP3 for general browsing Please suggest. Thank youMohammed Ali

How to Create QoS rule based on application

Hi, We need to create QoS rule based on application, like (business application it will use ISP1 and General browsing it will ISP2).

VirtualBox & SSL Decrypt

Hello, this is a FYI for those using SSL Decrypt. If you have SSL Decrypt turned on, the Oracle VM VirtualBox Manager application will not be able to check for updates via it's auto-update mechanism. You need to add "update.virtualbox.org" as a SSL decryption exception. The error message you get is: The network operation failed with the followin...

Resolved! One template in Panorama for HA pair of firewalls

Transition/migrate HA pair to firewall I followed those instructions https://www.paloaltonetworks.com/documentation/80/panorama/panorama_adminguide/manage-firewalls/migrate-a-firewall-to-panorama-management#_39720, steps from 1 to 7 and successfully migrated 3 HA pairs to Panorama management. After migration I've got in Panorama 3 device groups ...

"Fixed an Issue..." annoyances of release notes.

Is it a Palo Alto requirement that all descriptions of addressed issues must start with "Fixed an issue"?After reading through an exhaustive list of bug fixes it gets quite annoying. Bigger issue though, is there a bug database that is searchable? Current list of open bugs for a release or device?

NSS Labs NGFW 2017 report

Any thoughts or insights why Palo Alto dropped their ratings/score on the 2017 NSS Labs NGFW report?https://www.nsslabs.com/research-advisory/security-value-maps/2017/ngfw-svm-graphic/ Please share as we will be kicking off our evaluation process. Thanks.

Discussions