Firewallcrash because of Application cloud Engine (ACE)

Hi community Since about 2 weeks a vm firewall started getting problems with random crashes. Our setup is a firewallcluster but so far the active firewall crashes almost completely silent. At least the firewall does not initiate a failover to the passive node. So far we had about 4 crashes at random times and in one case the firewall crashed "...

About certificate

Migrating configuration from the firewall running PAN-OS 9.1 to new firewall running PAN-OS 11.1 directly

Hi LIVEcommunity I plan to migrate the configuration from a PA-3020 firewall currently running PAN-OS 9.1 to a new PA-1410 firewall running PAN-OS 11.1. I'd like to know if it's possible to directly import the configuration from the older firewall to the newer one, despite the difference in PAN-OS versions. If direct import isn't recommend...

Zscaler Traffic Pattern

My company users are using ZCC on their laptops. Recently, there has been an issue where Zscaler traffic is being denied by the Palo Alto Firewall.Upon checking the logs, it appears that the ZCC traffic pattern changed into web browsing and HTTP Proxy, which is being denied by the firewall. We have configured the firewall to allow Zscaler Privat...

Unable to Block Personal Gmail on Ubuntu Machines.

Hi Friends, We have a customer who is facing issues in blocking Personal Gmail on Ubuntu Machines. I have followed the below mentioned discussion and created the URL filtering and Policies. https://live.paloaltonetworks.com/t5/general-topics/block-access-to-private-gmail-but-allow-corporate/td-p/195686 Personal Gmail is blocking as expected ...

FW Policy Skipped When Either App-Based only or SMTP-BASE app and 587 Port is Defined

Firewall is skipping policy when the traffic has smtp-base port 587 on it. I created a firewall policy application based with smtp-base as application but it skips the policy goes to the implicit interzone deny policy. So I created it with by just port based, 587, it sill skips the policy and goes to interzone default deny. So I explicitly defin...

Migrate OpenBDS firewall to Palo Alto

What would be the best approach for migrating the OpenBDS firewall? In a scenario where there are 4 units of OpenBDS and consolidating into 2 units of Palo Alto. Would the Expedition tool able to merge the policies? Any other things to note for the migration? Please advise.

Looking for someone familiar with Palo Alto Firewalls

Hello all, I'm with a company that has just been offered a project to review a certain university's firewalls but we can't take it on as none of us are familiar with Palo Alto systems. However it would be nice to be able to take on projects like this to expand our scope of services. I thought I would come on the community site in hopes of luck...

Global Protect Integration with Azure SAML w/ Multiple Gateways

I'm trying to setup an integration with 2 firewalls at different locations. The portal and 1 gateway reside on 1 of the firewalls, and i've used this: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g0000008U48CAE to get that going successfully. The 2nd firewall, which has a certificate w/ a different FQDN, doesn't allow...

ospf neighbour adjacency is flapping continuously

Hi Team, Reaching out for help to identify the main cause of this problem. I can see that the OSPF adjacency is flapping continuously and I have no clue how to move further and how to identify the cause. While collecting the routed.log, I can see below: **** AUDIT 0x0309 - 57 (0001) **** I:0087de60 F:00000002i3emuif2.c 484 :at 15:13:10, ...

Palo Alto and Microsoft NLB multicast

Hi I have an issue to contact the VIP of our Microsoft NLB. We have a cluster of 2 PA-1410 (active/passive). On this cluster, I configured interface aggregate with sub-interfaces with ID vlan (ex :vlan10, vlan 50, vlan193..). Each IP of the interface VLAN is the gateway configured on my servers. On the VLAN193, I have 2 Windows servers with ...