This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
General Topics
Post a discussion here if you have general questions regarding configuration and troubleshooting for Palo Alto Networks products. Use this forum to collaborate with like-minded security professionals to improve your security posture.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
General Topics
Post a discussion here if you have general questions regarding configuration and troubleshooting for Palo Alto Networks products. Use this forum to collaborate with like-minded security professionals to improve your security posture.
About General Topics
Post a discussion here if you have general questions regarding configuration and troubleshooting for Palo Alto Networks products. Use this forum to collaborate with like-minded security professionals to improve your security posture.

Discussions

Start a conversation

CIE group (created on EntraID and Okta) visible in CIE but not recognized by PAN-OS firewall

Hi everyone, I’m troubleshooting a CIE group mapping issue on a firewall and would appreciate some advice. The setup is: PAN-OS 11.1.13-h9 Panorama-managed firewall CIE using Okta as the directory source Okta receives groups from both its own directory and MS Entra GP uses these groups in Portal Agent Config and Gateway configuration...

Meed by • L0 Member
  • 40 Views
  • 0 replies
  • 0 Likes

SSL Decryption Issue on PA-520 Running PAN-OS 12.1.7-h3

We are experiencing an issue with SSL decryption on a PA-520 running PAN-OS 12.1.7-h3. After enabling decryption, the firewall operates normally for approximately three hours. However, over time, the number of decryption failures gradually increases until all new connections are rejected. Disabling decryption immediately restores normal operatio...

User-ID in FIPS-CC

Hello, I am having an issue setting up user-id when the firewall is in FIPS-CC mode. Here is the following issue: Environment: PA-3440, PAN-OS 11.2.10-h7, FIPS-CC mode enabled Windows User-ID Agent v11.0.3-134 (identical version on both hosts) Issue:I have two Windows-based User-ID Agents configured under Device > Data Redistribution &g...

PAN-OS 11.1.16, Unable to connect to VPN Portal or Gateway, winhttpObj, error!

We have a NGFW hosted by Rackspace in the US. Any new attempt to connect to the Global Protect gateway portal fails. We can ping and tracert to the I.P. address and domain of the gateway, but whenever we go to connect via the Global Protect VPN client or we attempt to go to the web portal via browser the connection fails with an EMPTY_RESPONSE. ...

josh by • L0 Member
  • 113 Views
  • 1 replies
  • 0 Likes

How to check Cloud NGFW for Azure OS upgrade history

We are using Palo Alto Cloud NGFW for Azure and need to verify the OS/software upgrade details for our deployed firewalls. Could you please let us know: How to check the current PAN-OS/software version running on Cloud NGFW? Where can we find the OS upgrade start time and end time for previous upgrades? Are upgrade logs available in Azure Porta...

Quest Asc - TSF Upload take forever

I am trying to upload a TSF to the Quest Asc tool, The TSF is 120 MB. When I upload no error but it keeps spinning. I have tried it few times and no luck. I have a good stable internet and good upload/download speed. Tried different browser but no luck. The only thing I can think off is Netskope but don't see any blocks either.

ArunKu by • L0 Member
  • 1075 Views
  • 4 replies
  • 0 Likes

Unable to Commit Changes after Installing New Certificate

I was asked to assist with a new wildcard certificate that was uploaded to the firewall yesterday, update the SSL/TLS Service Profile and confirmed settings for GP. Commit failed so began reviewing configuration. The 2 reasons listed for the failure were: client useridd phase 1 failureclient gp_broker phase 1 failure Double checking and the...

DJ_1924 by • L2 Linker
  • 288 Views
  • 4 replies
  • 0 Likes

FWs no longer forwarding logs to Panorama

Not sure what happened but it seems that all my firewalls stop sending logs to panorama (local log collector). I have a ticket open with PAN support but not really getting anywhere. Recently upgraded PANORAMA to 11.1.13-h3 and added additional collector disks to PANORAMA. Also forwarded logs from PANORAMA log collector to our syslog serv...

drewdown_0-1788476521190.png
drewdown_2-1788476742998.png
drewdown_1-1788476583659.png
drewdown_3-1788476808559.png
drewdown by • L4 Transporter
  • 188 Views
  • 2 replies
  • 0 Likes

Antivirus mismatch without license

We have a cluster of firewalls with an antivirus mismatch alert. The thing is that there is no antivirus license.This issue happpened after one of the nodes went down and we had to perform a factory reset. We are seeing this by cli: av-version: 0 av-release-date: threat-version: 0 threat-release-date: 2025/02/10 19:10:10 CET I know it does not a...

can we allow sign in to webex only using defined company account ?

I have followed below article and tried to configure http header insertion in URL filtering profile , but still able to login using other company account.https://help.webex.com/en-us/m0jby2/Configure-a-List-of-Allowed-Domains-to-Access-Webex-While-on-Your-Corporate-Network#task_C0E05337A65BA687DD68241E79076D38 Also in url filtering log, no logs ...

Deepak25 by • L3 Networker
  • 6332 Views
  • 5 replies
  • 0 Likes

VPN with two subnets

Hello, We are using globalprotect for users to connect to our network, but recently we have another set of users that we would like to put them on a separate network. We created another profile on the Gateway specifying that if certain users, we have connection with SAML, should receive the IP address of the secondary subnet. We moved this p...

YParreno by • L1 Bithead
  • 266 Views
  • 4 replies
  • 0 Likes

Is there anything shown in the system log when the password change date for the Palo Alto firewall administrator account is about to expire?

When setting the password complexity on the Palo Alto firewall, I set only the expiration date to 60 days and locked the account. Is there a way to keep or leave related logs in the system log before the expiration date? If there is any content, please also provide a link to a site where I can refer to it.

Resolved! Step to change standalone for both device

Hi All, All our PA is managed by Panorama and there are a couple of HA pairs in our environment. we just want to change one of the HA pair to standalone. Currently our set up is active passive. We would like change to standalone on both device. Is there any steps to make this happen? Thanks !!

  • 24449 Posts
  • 125 Subscriptions
Top Solution Authors
View All
Labels
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks