Deep Packet Inspection and SSL Certificate

Hello, newbie here. One of our clients asked me: 

"We have an exchange server which is on site.  We need to renew the ssl certificate, I was told that if the Palo Alto firewall performs deep packet inspection, we need to supply the ssl certificate

How to install a Cortex XDR agent communicating through the Palo Alto Networks Broker VM?

1. I installed Cortex XDR Agents before setting up the Broker VM.

I want all the agents to route traffic through the Broker VM as a proxy. The Broker VM is activated and connected.

Should I uninstall the existing agents and reinstall them using the f

For those that seek to get SSH Proxy working

Searching the internet it seems that people are looking to enable SSH Proxy and not finding answers. I managed to get it working but must say that the current supported SSH decrytion parameters for all PAN-OS versions aren't the most secure ones so y

When will PAN-OS start supporting modern SSH ciphers?

I'm running PAN-OS 11.1 and OpenSSH 9.X.

I had to tune my sshd_config to support really ancient stuff like aesXXX-ctr and hmac-sha1 just to allow for SSH decrytion...

Please Palo Alto update the supported ciphers and MACs!!

Terminal Server Agent: Start service fails with error 1058!

Does anyone know of a fix to this error with the Terminal Server Agent?  Only two of my servers aren't connecting and I'm getting this error message.  

unable to open a case

I have a new support account, but there appears to be a problem.  URL is https://support.paloaltonetworks.com/Error/Error.

I need to open a case for a critical issue.

PA-VM MGT not reachable in GCP.

I have PA-VM deployed in GCP with SD-WAN. PA-VM sits behind SD-WAN for intranet traffic.
attached image is how my setup looks like .

Query.

I can't reach firewall mgmt via internal network (access via Public IP to mgt Public works fine) . everything o

Mulit-Vsys setup with Wildfire

Hi Friends,

We are planning for a multi-vsys PA setup, where one vsys will have only L3/L4 policies and second vsys will be in L2 bridge mode with Threat prevention features only.

Vsys1 will only scan L3/L3 policies while vsys2 will scan traffic fo

advanced url filtering question

https://www.paloaltonetworks.com/apps/pan/public/downloadResource?pagePath=/content/pan/en_US/resources/datasheets/advanced-url-filtering

how can i configure the firewall with Advanced URL filtering license to protect the following item

> Antievasion

Prisma Cloud Integration with Oracle cloud (OCI)

We are trying to integrate oracle cloud (oci), Looking for documentation

A very weird Behavior on SIP traffic traffic reversing back to the same egress interface

Hello everyone , im seeing a very strange behaviour in my pa-445 version 11.1.4-h7 firewall , where i have an interface on the firewall which is a gateway to my voip devices , the same firewall connects to the voice server through an ipsec tunnel int

PA-VM sysd_construct_sync_importer

We got a customer that runs into this issue recently, it's a known issue (not public) for versions 11.0.0, 10.2.3, 10.2.2-h1 (and also to us 10.2.3-h2, 10.2.2-2).

When you run into this, means that there's a hardware issue, please go to TAC in order

How to create ACLs for access to AWS workspaces (EDLs don't cover all IPs)

I need to create ACLs for outbound access to AWS workspaces using the destination IPs / subnets / FQDNs shown on AWS publication https://docs.aws.amazon.com/workspaces/latest/adminguide/workspaces-port-requirements.html#ip-address-regions.  

PAN pu

PaloAlto Passive Firewall Monitoring in HA Setup

Hi everyone,
Greetings!

I’m currently using OpManager to monitor a Palo Alto firewall in an HA Active/Passive setup, and the Link State of the interfaces on the passive device is set to auto.
While OpManager is able to correctly pull interface details