Next-Generation Firewall Discussions

Welcome to the Next-Generation Firewall Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

How to avoid split brain in active passive cluster

Hi, We've got a installation with active-passive devices in different datacenters. We need to ensure that the primary device is always the active device when there is some problem between datacenters. We have configured virtual router path monitoring in the secondary device so it can check that the primary device is not reachable. But for so...

ACC Export PDF of application usage lack of colour

Hi all, I found that when I Export PDF report of ACC application usage, the report cannot be displayed normally, it will be lack of colour of each application grid like below How can I solve it? Is it normal or not? Any document mention this?

LACP load balancing algorithm

Hello Team, Where I can find information about how traffic balance between physical interfaces in case when LACP used?Can I choose balancing method in configuration (source/destination, MAC/IP Addr, L4 Ports)? I found information about traffic distribution mechanism in LAG for early versions of software (prior 6.1😞https://knowledgebase.paloalto...

Logs showing same Zone for interzone traffic

HI team,We are try to reach from one zone to another zone in Palo alto firewall. We are able to reach but in the logs something weird we are seeing. the source zone and destination zone is same in the logs for different zone traffic. Is there any clue about this why its happening ?Thanks in advance.

PA-VM HA Clustering architecture

Hi All, We are working to deploy 4xPA-VM 300 firewalls in our 2 DCs. We would like to have a pair of Active/Passive firewalls in each DC. We would then want these 4 firewalls to be in a cluster as well. Our objective is to have complete redundancy across DCs and intra-DC as well, but these firewalls to work as logically same firewalls and a...

How to identify pinned certificates?

Hi, How can I find out if the site is using pinned certificate so that I can exclude the site from SSL decryption?

EDL and Custom URL

Hi There, Problem Statement : We have custom URL lists(To allow Azure Endpoints only), also we have EDL(With Minemeld) integrated. As per our Infosec Policy we should not use Minemeld feed for Microsoft as it has some of many wildcard. So desperately creating custom URL for each MSFT end points(viz Defender, AAD heath etc,,) But some of URL is ...

Slow throughput issue over IPSec VPN tunnel configured between Fortigate 100F and Palo Alto

Hi Team, Slow throughput issue over IPSec VPN tunnel configured between Fortigate 100F and Palo Alto.What are the recommendation for the MTU size for the IPsec tunnel in palo alto as default MTU on the interface is 9192. Regards,Umesh Kumar

PA220 Slow management on 10.x

Hi. So on the 10.1.6 known issues list, it still lists 220's as taking more than an hour to upgrade and has slow management interfaces. However, I don't see that it's mentioned on the known issues nor the addressed issues for 10.2.x. Is it still an issue? Hesitant to upgrade to 10.2 in fear of completely breaking my 220's. TIA

Globalprotect clientless portal link persistence using SAML through cloud identity engine.

Hello, Just wondering if someone can shed some light on link persistence when redirecting through Palo Alto cloud identity engine. In our previous config which was Local user authentication based, an automatically generated link which would open a response page on a server within our AWS VPC could be clicked and it would take us to the local GP ...

Can we input address range directly to security policy source and destination

Hi, In firewall version 8.1, Can we input address range directly to security policy source and destination?Thank you.

Palo alto Implementation issue

Dears, I'm Trying To implement Palo alto based on VMWARE ESXI Machine and i need to Take in place the Redundancy in Network Design.The Image has been ttached which I am Trying to reach it with optimum solution Network Toplogy What I can do In Palo ALto and ESXI to make the design is successful to be executed ?Thanks and Regards

Palo alto Implementation issue

Dears, I'm Trying To implement Palo alto based on VMWARE ESXI Machine and i need to Take in place the Redundancy in Network Design.The Image has been ttached which I am Trying to reach it with optimum solution Network Toplogy What I can do In Palo ALto and ESXI to make the design is successful to be executed ?Thanks and Regards

Resolved! Permit statement isn't capturing all the traffic

We have a school tied to our organization that's using a PA-850 and is running 10.1.6, and we're trying to get Battle.net working. After considerable troubleshooting, I put in a rule at the very top to permit the "zESports" zone to get to any IP on any zone. See the eSport_to_all_rule image. For some reason, some packets completely bypass this r...