Auto Commit Failed and Gray Interfaces after upgrade to 11.0.2-h2

Upgraded to 11.0.2-h2 on my 410 last night and the interfaces were all showing gray after reboot. Auto commit was failing with the following error and just kept trying and trying.

client device phase 1 failure
Management server failed to send phase

OSPF issue betwwen PA VM-100 and Cisco 4431

Hello everyon,

I have an strange issue with OSPF, it is working normaly but one or two time in 24 hour palo alto loses its neighbors for 1 to 5 seconds. 

I tied to troubleshoot and get message:

**** AUDIT 0x3e01 - 210 (0000) **** I:001d0046 F:00000

SFTP file transfer restrict

Is there a way to restrict the use of SFTP for file transfers?

The condition must be allowed SFTP, but restrict only permit upload and deny download, or only permit download and deny upload.

application based rule

Hi All ,
We are planning to implement application based rule like under application tab add required app and under service tab add application default.
However what would be best approach to apply rule where application is showing "incomplete".
Currentl

URL Lookup Returns IP Address

We use a URL filtering profile to limit outbound traffic.  Occasionally known good traffic will fail because an IP address, instead of the FQDN of the URL, is presented.  The traffic is blocked because the URL (IP address) is in the "Unknown" URL cat

Syslog issue

Hello All,

When we are using 9.1.14 Pan os we are getting below "" between ,, after upgrading 10.1.10-h2 it  is missing.....

Is there any way to get back the double quote like early?

Cloud Identity Engine (CIE) and group mapping on firewalls - Groups and/or group membership updates not working as expected

I just wanted to let more folks know about this KB article concerning Cloud Identity Engine (CIE) and group mapping on firewalls. Knowing about this issue documented in the KB ahead of time would have saved a lot of frustration for us. Its informatio

Is there a way to allow LDAP StartTLS While blocking normal unencrypted LDAP?

Is there a way to allow LDAP StartTLS While blocking normal unencrypted LDAP?

Custom URL category matching

Hello,

I'm trying to block a domain but allowing specific URL.

like:

test.com/ - block

test.com/test - allow

I made two custom categories and rules, first rule for allowing "test.com/test" and second rule for blocking "test.com"

The connection is h