This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Next-Generation Firewall Discussions
Palo Alto Networks Next-Generation Firewalls provide true, complete visibility everywhere, along with precise policy control. Ask your questions or provide insightful answers in the discussion forum specific to NGFW.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Next-Generation Firewall Discussions
Palo Alto Networks Next-Generation Firewalls provide true, complete visibility everywhere, along with precise policy control. Ask your questions or provide insightful answers in the discussion forum specific to NGFW.
About Next-Generation Firewall Discussions
Palo Alto Networks Next-Generation Firewalls provide true, complete visibility everywhere, along with precise policy control. Ask your questions or provide insightful answers in the discussion forum specific to NGFW.

Discussions

Start a conversation

Welcome to the Next-Generation Firewall Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

JayGolf by • Community Team Member
  • 4518 Views
  • 0 replies
  • 1 Likes

Why would an active firewall in an active-passive HA configuration broadcast gratuitous ARPs every 60 seconds?

I found a KB article stating that the active firewall sends out gratuitous ARPs every 60 seconds during normal operation, but it doesn't explain why. What is the reason for this behaviour? https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000004Ny3CAE

HA failover on Acitve Passive concerns

Hello all, I would like to get some idea/thoughts about the current setup on my two PA1410 Active/Passive FW failover concerns. Few weeks ago, our Active FW has some issues and hung on the data plane. I found there was some missing configurations on our network side so the Failover didn't work at all. So eventually I resumed it, and raised the...

Global Protect is having issues with newer MACOS version.

Hi, I have problems trying to sign in some mac users that are running some SEQUOIA and TAHOE version, the only version that is working is 15.7.4 Sequoia version. It seems that the gl client is unable to authenticate. I checked in logs and it seems that the gp client is not able to open a .dat file 04/15/2026 17:06:14:954 [Info ]: Portal pre...

Firewall SSH, the login succeeds with TACACS Account, but there is an issue that closes the session immediately.

Hello, everyone. Firewall has OS of 10.2.4-H2. When TACACS account to connect to Firewall SSH, the login succeeds, but there is an issue that closes the session immediately. In Firewall System-log, authentication and authorization were successful and it was confirmed that the Superuser role was granted.. However, a "create-admin-acct-err...

hbshin by • L2 Linker
  • 2342 Views
  • 3 replies
  • 0 Likes

Rapid7 Insight Agent not showing as vendor in HIP Object Anti-Malware tab despite OPSWAT V4 support

Hi everyone, I'm trying to configure a HIP Object to detect Rapid7 Insight Agent as an antimalware vendor, but the vendor doesn't appear in the Anti-Malware dropdown when creating the HIP Object. According to the OPSWAT support chart (software.opswat.com), Rapid7 Insight Agent is listed under Signature 4098 with categories ANTIMALWARE and HEAL...

VPN peer ID

Hi guys, we have a 3rd party VPN peer who must set the Peer Identification value, the tunnel works fine, but on their side the tunnel ID IP address can change depending on whether they are on their active or standby firewall, and that means we need to update config and push policy to get it online (this is a regular occurrence) I thought abo...

PAN-275077 is this bug still affected in 11.1.10-h1?

I am currently observing behavior where both Sinkhole and Alert actions are being logged simultaneously for the same malicious domain. When performing an nslookup from the affected endpoint, the domain resolves correctly to the Sinkhole IP, which indicates that the sinkhole functionality is working as expected. However, I continue to see “Aler...

TS-Agent 11.1.1 Compatibility

The Compatibility Matrix shows that TS-Agent 11.1.0 is compatible with (only) Citrix XenApp 7.x According to the matrix, the TS-Agent 11.1.1 is not compatible with ANY version of Citrix XenApp Is this correct? Has TS-Agent 11.1.1 deprecated all support for Citrix? There is nothing in the release notes to suggest this which would seemto be a...

djr_0-1776240529102.png
djr by • L4 Transporter
  • 185 Views
  • 0 replies
  • 0 Likes

NGFW unable to fetch device certificate due to bug

Hi Team,In reference to PAN-313623 describes an issue on Palo Alto Networks firewalls with Trusted Platform Module (TPM), support where device certificate renewals, may fail due to a disk partition becoming full . This occurs because temporary .pub_pem files accumulate in the /opt/pancfg/mgmt/ssl/private/ directory and are not deleted during dev...

  • 1795 Posts
  • 60 Subscriptions
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks