GlobalProtect Machine based Certificate Access

Hi Long time listener, first time caller. Since we have so many brute force attacks with GlobalProtect lately, I wanted to do machine based GlobalProtect Certificate access. Meaning we use a third party Certificate server within our environment to create Certificate and I assume this server would also be Root CA. Then push cert to all devic...

Discard a candidate configuration

How to discard a candidate configuration, I changed the order of rules by mistake and I see a commit. How do I discard it?

Allow download no upload

Can some one help me on below requirement.Need to allow users to download only of files from online-storage and backup Category and we should restrict upload.thanks

Facing issues in login to the portal

client gp_broker phase 1 failure commit failed

Hello,If someone experiences an auto-commit failure after an upgrade with the error message "client gp_broker phase 1 failure commit failed," here i provide a workaround solution :show jobs allEnqueued Dequeued ID PositionInQ Type Status Result Completed--------------------------------------------------------------------------------------2025/01...

Finding FQDNs for blocked IP's or SSL-Inspection

Once a week, someone reports having issues accessing a site. Today that issue involves a credit card processing page that is aging-out because there is no SSL inspection exception. FW Logs of course show an IP address (no URL/FQDN), and the rule to allow access or exclude from ssl inspection requires using an FQDN. The page URL in address ba...

Dual ISP setup on 1 virtual router kb issue

Hello. so I need to setup a dual ISP setup and found below kb. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLL8CAOI know there is also one using different virtual routers but for this specific setup it seems this one is a slightly better match. however 1 thing in the kb bothers me and in the past when I did this set...

EDL is accessible but IP addresses are not populting in firewall

Hi All, I am currently facing an issue where the EDL is not populating with IP addresses, however, from the same EDL server URL list is populating fine. The EDL is already applied to a policy, and for testing i have added only one IP address in it. Any recommendations? Thank you.

Root Partition Full

Hi All, I am trying to clear root partition on our passive FW. It was suggested in one of the articles(https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClaJCAS)that we can try to delete Core Files. But Im kind of hesitant since its core and might be service impacting. Any one here can tell me which files can i de...

delayed traffic logging

Hi All, Some weird stuff going on on our unit: what are the chances that the firewall logged traffic that it received hours ago? In our case, the firewall logged RDP connections that occurred in the early morning. However, the target servers didn't log any login attempts at all. The alleged source IP of the connections was down during that p...

Paloalto standalone user-id agent and PANOS compatibility

Can standalone user-id agent version 9.1.5 work seamlessly with PANOS 11.1.5?In this compatibiltiy matrix User-ID Agent it shows only the compatibility between the user-id agent, the installed servers and the monitored server. Thank you for your help.

Direct DNS Resolution on Palo Alto Without DNS Proxy Enabled

Hello, It is possible to perform a DNS resolution directly from the Palo Alto firewall without relying on the current network configuration (such as the default configured DNS). The idea is to bypass internal DNS and use a public DNS directly, such as 8.8.8.8. Note that the DNS proxy is not enabled because it is not being used. Thanks