General Topics

Discover LIVEcommunity Through Our New Animated Explainer Video!

We’re thrilled to unveil a brand-new animated video that highlights everything LIVEcommunity has to offer! This short and engaging video gives you a quick tour of the many resources available in our vibrant community — from interactive discussions and customer journey guides to the Cyber Elite program and Member Spotlight features. Whether ...

Resolved! AWS output/aggregator with unexpected missing indicators

Hello, I have a dev and prod instance of MM. Noticed both dev and prod behaving the same way, where many indicators were not showing up in output feed for AWS miners. Config on both is the following: nodes: aws_route53_miner: inputs: [] output: true prototype: aws.ROUTE53 aws_ipv4_output: inputs: - aws_ipv4_aggreg...

Resolved! Security Policies Clarity

What is the difference between pre rules and post rules ? None of my colleagues could answer this question upto my satisfaction.Can I expect expert comments ?

Resolved! External feed URL and minemeld update URL

In our environment, there is a PA between Minemeld and the Internet, so PA access control. Would you please tell me the subject URL and port number ? (A specific external feed becomes O365 is https://paloaltonetworks.box.com/s/gndwe5rzheg1ekwplxb4m3mrpcf5k41f) Regards, Naoya

qos

Hi,After egress max set in the following order ,If 100 Mb is the internet speed and through the trust link (1 GB) traffic is going other than untrust ( internet zone ) , the below configuration is ok ? . class 1 10class 2 10class 3 10class 4 40class 5 10class 6 10class 7 5 class 8 5 Thanks

Best practice for setting up address groups

Hi Newbie to PA. I want to create a address group dynamic (think that might be best. made up from a group of network addresses in each DC. So for example if I have 3 DC dc1 - 10.1.0.0/16dc2 - 10.2.0.0/16dc3 - 10.3.0.0/16 I could tag them with "dc_network" Looking at dc3 I could make that a dynamic group say 10.3.1.0/2410.3.10.0/2410.3.100.0/24...

IKE Phase 1 Timeout

IKE is failing to negoriate phase 1. I get this timeout and then a delete. Any thoughts on the possible cause? I'm thinkingthe peer is perhaps not permitting the traffic from this device perhaps at a security device in front of their tunneling firewall (ASA). ? May 11th 2017, 10:39:04.000 <14>May 11 10:39:04 172.19.5.38 prdfw100-pri.inter...

Adding Multiple Individual IP addresses at one time.

In our environment we use tags on individual IP addresses for a few different things and then have policies in place to take those actions based on those tags. Sometimes we have requests come in with a lot of indivudla IP addresses that we have to add and tag in multiple VSYS's. This is tedious and time consuming because the only way I know how ...

Resolved! Global Protect 3.1.1 PAN-OS 7.1.5 split tunneling issue

Another one, Split Tunneling simply doesn't work: When trying to access resources on the Internet (google.com) all traffic is routed to the tunnel where no policy for the Internet access, hence no internet.

permitir videos en vimeo.com

estimados, alguien que pueda ayudarme a permitir el acceso a vimeo.com ? al intentar ingresar a esta pagina me aparece un error de certificado ssl:Este sitio no puede proporcionar una conexión seguravimeo.com envió una respuesta no válida. Intenta ejecutar el Diagnóstico de red de Windows.ERR_SSL_PROTOCOL_ERROR

iph1->ivm == NULL

Dears, Since two days i am getting this message "iph1->ivm == NULL" and all VPN with ASA on the other side is facing iKE Phase 1 time out

Best practice with defining Zones - how many is too many

Hi So I have 3 locations (DC), Internet access , Vendor access, environment (Prod, Uat etc) and user and support users and dmz and ... should each of these be a zone ??? I am thinking not, after have a bit of a play, you can't make dynamic zones from tags. So I am thinking zone_internet - where the interface talks to the internetzone_vendor - w...

Resolved! NAT and OSPF

Hi I have a PA-3060 (A-A). I have a NAT lests say 1.1.1.1: 443 -> 192.168.10.10:10000 now the PA is part of an OSPF network, how to I publish out the address 1.1.1.1 I was thinking of adding 1.1.1.1 to a loopback and adding to a virtual router and then adding the interface to OSPF. I read that I need a policy for src address: port -> 192....

Upgrade to 8.0.2 bricked my PA500

So am I the lucky one to have what should have been a simple upgrade brick the firewall?Was running 7.1.7, normal download and install 8.0.2Firewall came up with the yellow status light.Was able at that point to login to gui.Found this little darling message in the system log: System messages:'data_plane: Depend script failed max times'See datap...

Version upgrade to 7.1.8

Is version 7.1.8 the most stable os version? Are there any known problems with this version?

Resolved! Dynamic Updates on PA-200

I have a PA-200 that is configured to check for updates every half hour aprox. The thing is that Antivirus, Aplications and Threats are not installed as scheduled!!! When I log in to check, the check to Internet is done, but the package is not downloaded or instaled (in schedule task action in both is download-and-install) If I do it manualy, ev...

Discussions

Discover LIVEcommunity Through Our New Animated Explainer Video!