General Topics

User-ID stopped working / Failed to add group to id manager

Hi Folks,

just to let you know, since I found no KB Articel for this issue. Policy Push from Panorama respectively local Commit on the Firewalls ended in strange Error Message according Group Assignment to Policy.

vsys1
Error: Failed to add group to i

BFP with OSPF graceful restart causing outages during failover

Dear community!

In a active/passive configuration with OSPF graceful restart and BFD enabled, when we do failover we experience a downtime 1 minute after the failover and it takes about 10 seconds to be fixed.

Checking the logs it looks like the fi

HS Code and ECCN classification for PAN-PA-400-RACKTRAY

Which is the correct HS code for PAN-PA-400-RACKTRAY? Thanks for help.

About BUG PAN-226361 for PA-820 device running version 10.2.10-h9

Hello
I wanted to ask you a question about a problem I just encountered, I have seen the BUG PAN-226361 reproduced in the PA-820
equipment is in version 10.2.10-h9 and yet this BUG has been corrected in the hotfix 7 of the same version, does anyone kn

Issues with the Customer Support Portal (CSP)

When I sign into Palo Alto, there´s a problem with the "Customer Support Portal (CSP)" section. It appears in error, but when I try to contact them as indicated, nobody attends to me. What should I do? 

About API keys when using the curl command

About API key issuance
We understand that API keys are issued by executing the following curl command toward PA.
curl -k -X GET 'https://<PA-Firewall-IP>/api/?type=keygen&user=<username>&password=<password>

Regarding the issued API key, does a differ

What is the replacement of PCNSA certification?

Good morning, everyone

I was planning to take the PCNSA certification, but I surprised when I noticed that this certification was retired in January 2025.

My question is: What is the new certification that replace PCNSA and what is the study guide

Is it possible to configure PA to send a reset(rst) packet when a session timeout occurs?

Hello.

I'm running a PA-1420 device.
The PAN-OS version is 11.0.3-h12.

Is it possible to configure the PA to send RST packets to both sides when a TCP session times out due to aged-out?
I read in a previous post that this wasn't possible on the PA, but

Setting up a ION device in Azure

Hello,

We have 3 branch sites and we want to deploy a virtual ION device within our Azure tenant to connect it like another branch site.

1 - Is that possible? I see PA ION devices within Azure to deploy but I am not sure if it will accomplish wha

Issue with GP Access for JIO Users on PA-820

Dear Friends,

One of our customer is facing an issue with users on PA-820. According to the customer, many users are connecting to the internet via mobile hotspot using JIO SIM cards. While they can successfully connect to GlobalProtect, but they a

Issues GP in Iphones

On iPhone, the  gw for SAML authentication does not open the system browser (Safari). It opens the embedded browser. We configured the "default browser" in APP config like YES. 

In android is working fine but no in iPhones. Why? any incompatibili

we have High Severity tickets for ALERT: Warning - AAA - [Free Disk Space

/opt/traps below servers’ issue

[root@usaz15ls128 ~]# df -h /opt
Filesystem Size Used Avail Use% Mounted on
/dev/mapper/vgRoot-lvOpt 6.0G 6.0G 20K 100% /opt

[root@usaz15ls128 ~]# du -sh /opt/traps/
5.7G /opt/traps/
[root@usaz15ls128 ~]#

[root@usaz15ls132

Policy processing order

I have a question about how policies are processed; specifically NAT vs Security Policy.

We have a NAT policy that performs destination NAT to translate all traffic to port 53 to be translated to our corporate DNS servers.

We have a security poli

Where to find information about SSL decryption is (not) required to identified traffic

Hello guys,

I want to know if there is a resource where I can find if SSL decryption is required or not to identified the APP traffic. 

I have this information inside Palo Alto Networks Content Update mail but I don't find this information in app