This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Next-Generation Firewall Discussions
Palo Alto Networks Next-Generation Firewalls provide true, complete visibility everywhere, along with precise policy control. Ask your questions or provide insightful answers in the discussion forum specific to NGFW.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Next-Generation Firewall Discussions
Palo Alto Networks Next-Generation Firewalls provide true, complete visibility everywhere, along with precise policy control. Ask your questions or provide insightful answers in the discussion forum specific to NGFW.
About Next-Generation Firewall Discussions
Palo Alto Networks Next-Generation Firewalls provide true, complete visibility everywhere, along with precise policy control. Ask your questions or provide insightful answers in the discussion forum specific to NGFW.

Discussions

Start a conversation

Welcome to the Next-Generation Firewall Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

JayGolf by • Community Team Member
  • 4793 Views
  • 0 replies
  • 1 Likes

LACP Port Channel Link Flap between Cisco PA-445 and IR9320

Hello,We have a Palo Alto PA-445 firewall connected to a pair of Cisco IE9320 core switches configured as a stack, with one link connected to each switch. The links are configured in a Port-Channel on the Cisco side and as an AE (Aggregate Ethernet) interface on the Palo Alto firewall. Additionally, the MAC persistency timer is configured to 0 o...

Him143u by • L0 Member
  • 194 Views
  • 1 replies
  • 0 Likes

VPN Performance over Prisma Access : slow downloads

Hi, Can somebody tell met what you can expect from downloading a file over prisma access backbone. Our datacenter is connected to service connection and when I try to download a 200 Mbps file from the datacenter to a remote network located in the same region, I am getting a download speed of 500Kbps per second.(smb transfer) Within the remote ...

zGomez by • L3 Networker
  • 9691 Views
  • 9 replies
  • 0 Likes

PA-220 Login issue

Hi Everyone We have a load of PA-220's in HA at variuos different sites, after a set period of time the devices stop allowing use to login. Does not matter what method of Auth we try, it just does not work. To compond the problem, if we do not resolve this issue eariler enough both devices at the site go offline taking the whole site down. ...

R.Moth by • L1 Bithead
  • 536 Views
  • 6 replies
  • 0 Likes

3 node cluster or HA

Hi community. I am setting up a palo alto firewalls for a customer and they need it as 3 nodes. they are going to be placed in three different buidling inside the same campus. I have gone through the documents and seeing that clustering is the only option as it is 3 in number. I want to know is there any way that i can make this into HA of ...

License expired

hello guru, what will happen if my either the support and CDSS license expired? I assumed the CDSS function will not work because no signature updates. how about Firewall, NAT and VPN? thanks,

Commit failed and firewall now down after reboot

Hi, I have a weird issue on a cluster of two firewalls on active/active mode. Yesterday I tried to commit a small change on our policy, it was OK on the primary but it de-sync the secondary so I tried to sync to peer manually with no luck. On the secondary I tried to commit localy and I had this error : Unable to generate IKE VPN transform(Mod...

pa-460 version 11.1.13-h7

Hi Team, please help me out with this issue an incident occurred on the PA-460 version 11.1.13-h7 A firewall, initially associated with intermittent issues on the Internet connection provided by Totalplay.During the incident analysis, it was determined that it was not possible to access the firewall’s graphical management interface. Access via ...

F.Pinar by • L3 Networker
  • 253 Views
  • 0 replies
  • 0 Likes

HTTP partial response - Security protection bypass

The Palo Firewall supports HTTP partial response and is enabled by default, best practice is to disable HTTP partial response but this is a global setting. Doing so will break access to numerous internet based systems like youtube, and a number of other systems that utilise chuck encoding, including palo's own content updates. When HTTP parti...

DaMonk by • L1 Bithead
  • 322 Views
  • 0 replies
  • 2 Likes

Resolved! Policy Optimizer not available in PAN-OS 12.1

Hello there, with the brand-new PA-520 and PAN-OS 12.1.4-h3 is the Policy Optimizer missing (see my screenshots). I have found this info "(PAN-OS 12.1.2 and later versions) To ensure the best performance, customize your view to display the Policy Optimizer, only when you need it. The system fetches data for this component on-demand, which prev...

J.Dhling by • L2 Linker
  • 1425 Views
  • 5 replies
  • 0 Likes

Sizing help — university internet edge, 3 Gbps today, 4,000–5,000 students, 7-year lifespan. PA-3430 / PA-3440 / PA-5410?

Looking for sizing advice from anyone running PAN at a university/campus internet edge. Environment: University with 4,000–5,000 students plus staff/faculty Current internet bandwidth: 3 Gbps — expect this to grow substantially over the appliance's life (bandwidth per student keeps climbing; wouldn't be surprised to hit 8–10 Gbps by end of life...

simsim by • L4 Transporter
  • 386 Views
  • 0 replies
  • 0 Likes

Best free Syslog server 2026

Hi everyone, we are currently trying to set up a syslog server as we would want to retain older logs in case we need it for auditing purposes. We are looking for a free one that's good in 2026. I'm currently choosing between an ELK stack and Wazuh, which would be easier? I have experience in setting up Docker containers. Was looking at Graylogs ...

Sizing PA-Series for internet edge — 3 Gbps today, growing to 8–9 Gbps, with SSL decryption. Which model?

Sizing an edge firewall for a university campus and would appreciate real-world input from people running decryption at scale. Requirements: Internet edge only — no east-west/inter-VLAN (core switches handle that) Current internet traffic: ~3 Gbps, growing to 8–9 Gbps over the appliance's 5–7 year lifecycle Security profile: Threat Prevention (...

simsim by • L4 Transporter
  • 345 Views
  • 0 replies
  • 1 Likes
  • 1636 Posts
  • 62 Subscriptions
Top Solution Authors
View All
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks