General Topics

Discover LIVEcommunity Through Our New Animated Explainer Video!

We’re thrilled to unveil a brand-new animated video that highlights everything LIVEcommunity has to offer! This short and engaging video gives you a quick tour of the many resources available in our vibrant community — from interactive discussions and customer journey guides to the Cyber Elite program and Member Spotlight features. Whether ...

Resolved! Understanding Virtual Firewall exported XML configuration

Hello. The XML configuration for the firewall was exported and I am trying to understand the XML tag meanings. Is there any good documentation for the firewall configuration XML tags or file itself? Thanks.

Resolved! Can't set management interface network settings on 8.0 ESX VM

Hi, I have configured the management interface by logging in to the VM and going into configure mode and executing:set deviceconfig system ip-address 172.18.11.205 netmask 255.255.255.224set deviceconfig system default-gateway 172.18.11.193and thencommit I've tried to ping the default gateway but it fails. Also, I do a "show interface managemen...

Resolved! Incomplete traffic: custom appID and QoS

Hi, I have traffic generated by Solarwinds NetPath probes that is tagged by the firewall as "incomplete". I run a packet trace, and after the handshake, there are only TCP-keep-alive packets. I'd like to prioritize this traffic in QoS, currently I'm seeing high latency on NetPath at our busiest sites, and I'm thinking this may be because of QoS...

Sophos Central firewall rules question

My company is trying to implement Sophos central throughout our network.All clients need the access listed in the article below. https://community.sophos.com/kb/en-us/121936 Currently Sophos central doesn't support the proxy solution we use. what is the best way to allow access through our Palo? Is it url filtering or a custom application?

Resolved! Decryption Policy Rule - Profile is None

With my new employer I'm managing a 3050 unit with a couple of Decryption Policy Rules which are configured to decrypt using SSL Forward Proxy. The Decryption Profile under Options is set to None. I can't find what the behaviour is when the decryption profile is set to None.I appreciate any help.Jeff

Resolved! Content update 709 revoked?

All firewalls automatically downgraded content version from 709 to 708. Was 709 revoked? Anybody else having the same behavior?

Getting an error on Minemeld when trying to create a new miner node!

Hi, so I am new to MineMeld and I just installed in on my VM Ubuntu 14.04 LTS. I deleted the default miners and tried to add one myself but I keep getting an error during the polling:Errno bad handshake [('SSL routines', SSL23_GET_SEVERE_HELLO 'unknown protocol'])Please help! how do i fix this?

Resolved! PA 500 Upgrade to PANOS 8.0.2

My PA500 is currently on PanOS version 7.1.7, can I upgrade driectly to version 8.0.2?Or do I need to upgrade to verion 8.0.0 first and then version 8.0.2? Thanks for your help.

GlobalProtect commit fail on PAN-OS 7.0

help me please.config ip pool for client access but commit failcommit log messageOperation CommitResult FailedDetailsmissing ip pool from both dynamic ip pool and authentication server ip pool for config 'default' in gateway GP-Gateway (tunnel GP-Gateway-N)(Module: rasmgr)Commit failedrasmgr log message2015-07-10 17:52:29.746 +0700 rasmgr: rasmg...

Detalied url log

Hi all!i'm new in this community and we have put in work 2 PA-3020.I configured ELK for log forwarding.i've search every log and i couldn't find a filed with the url theat a user is visiting. Is there a way to achieve that.Example! Now i'm writing from this url: https://live.paloaltonetworks.com/t5/forums/postpage/choose-node/true/interaction-st...

Internal traffic is hitting in the isp firewall

Palo alto is perimeter to customer which is connected to isp firewall.Internal subnet traffics which are not allowed in isp/ untrust interface are hitted in isp firewall.Routing is proper. ARP is proper in isp interface( only next hop arp is there)Implicit deny policy blocking the interzone traffic trust to untrust.We don't have any clue how our...

Resolved! MP utilization high after the HA failover to primary

When Secondary Firewall became active, management plane utilization is not more than 10% for over months.Last week manual failover made, Primary is active now. MP utilization is above 60% all the time. All the configurations are same as it's in HA. Both firewall has 10+ unused FQDN objects and FQDN refresh happening for every 30 seconds eventhou...

From the Experts: URL filtering implementation and troubleshooting

I just wanted to check with anyone that can answer, that when the URL license expires, the whole feature is disabled in PanOS 8.0.1. It used to be different, the URL filtering would still work, but there were no more updates of the database. Thanks!

Resolved! Panorama question

Why is it for network / interface / <some interface> I can't use a name for a zone. I wanted to have a template that had all of my zones in it, but unlike policies and objects there is no shared attribute. Which means I have recreate my zones for each template I have interface definitions. Am I missing something ??

PA-220 Aggregate Interface with LACP supported?

Hi, I need to confirm whether the PA-220 is able to aggregate 2 interfaces or more in a LAG (LACP). I was able to find out that the PA-200 does not support aggregating interfaces with LACP, but the PA-220 is rather new and I have not been able to find a definitive statement about it. The product comparison indicates that it should be suported on...

Discussions

Discover LIVEcommunity Through Our New Animated Explainer Video!

Resolved! Understanding Virtual Firewall exported XML configuration

Resolved! Can't set management interface network settings on 8.0 ESX VM

Resolved! Incomplete traffic: custom appID and QoS

Sophos Central firewall rules question